* [PATCH v4 1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature
From: Luiz Augusto von Dentz @ 2026-05-07 17:42 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds initial support for SCI related commands, command bits, event
event mask bit and feature bits:
Events:
HCI_LE_Connection_Rate_Change(0x37)
Commands:
HCI_LE_Connection_Rate_Request(0x20a1)
HCI_LE_Set_Default_Rate_Parameters(0x20a2)
HCI_LE_Read_Minimum_Supported_Connection_Interval(0x20a3)
Also update the init sequence to incorporte support for reading SCI
groups and then setting the Default Rate
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci.h | 52 ++++++++++++++++++++
include/net/bluetooth/hci_core.h | 15 ++++++
net/bluetooth/hci_core.c | 14 +++++-
net/bluetooth/hci_event.c | 60 +++++++++++++++++++++++
net/bluetooth/hci_sync.c | 83 +++++++++++++++++++++++++++++++-
5 files changed, 222 insertions(+), 2 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 572b1c620c5d..848ec42de827 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -656,6 +656,7 @@ enum {
#define HCI_LE_LL_EXT_FEATURE 0x80
#define HCI_LE_CS 0x40
#define HCI_LE_CS_HOST 0x80
+#define HCI_LE_SCI 0x01
/* Connection modes */
#define HCI_CM_ACTIVE 0x0000
@@ -2486,6 +2487,46 @@ struct hci_rp_le_cs_test {
#define HCI_OP_LE_CS_TEST_END 0x2096
+#define HCI_OP_LE_CONN_RATE 0x20a1
+struct hci_cp_le_conn_rate {
+ __le16 handle;
+ __le16 interval_min;
+ __le16 interval_max;
+ __le16 subrate_min;
+ __le16 subrate_max;
+ __le16 max_latency;
+ __le16 cont_num;
+ __le16 supv_timeout;
+ __le16 min_ce_len;
+ __le16 max_ce_len;
+} __packed;
+
+#define HCI_OP_LE_SET_DEF_RATE 0x20a2
+struct hci_cp_le_set_def_rate {
+ __le16 interval_min;
+ __le16 interval_max;
+ __le16 subrate_min;
+ __le16 subrate_max;
+ __le16 max_latency;
+ __le16 cont_num;
+ __le16 supv_timeout;
+ __le16 min_ce_len;
+ __le16 max_ce_len;
+} __packed;
+
+#define HCI_OP_LE_READ_CONN_INTERVAL 0x20a3
+struct hci_le_conn_interval_group {
+ __le16 min;
+ __le16 max;
+ __le16 stride;
+} __packed;
+
+struct hci_rp_le_read_conn_interval {
+ __u8 status;
+ __u8 num_grps;
+ struct hci_le_conn_interval_group grps[] __counted_by(num_grps);
+} __packed;
+
/* ---- HCI Events ---- */
struct hci_ev_status {
__u8 status;
@@ -3300,6 +3341,17 @@ struct hci_evt_le_cs_test_end_complete {
__u8 status;
} __packed;
+#define HCI_EVT_LE_CONN_RATE_CHANGE 0x37
+struct hci_evt_le_conn_rate_change {
+ __u8 status;
+ __le16 handle;
+ __le16 interval;
+ __le16 subrate;
+ __le16 latency;
+ __le16 cont_number;
+ __le16 supv_timeout;
+} __packed;
+
#define HCI_EV_VENDOR 0xff
/* Internal events generated by Bluetooth stack */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index aa600fbf9a53..61872403fe65 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -333,6 +333,14 @@ struct adv_monitor {
#define HCI_ADV_MONITOR_EXT_NONE 1
#define HCI_ADV_MONITOR_EXT_MSFT 2
+
+struct sci_group {
+ struct list_head list;
+ __u16 min;
+ __u16 max;
+ __u16 stride;
+};
+
#define HCI_MAX_SHORT_NAME_LENGTH 10
#define HCI_CONN_HANDLE_MAX 0x0eff
@@ -572,6 +580,7 @@ struct hci_dev {
struct list_head pend_le_reports;
struct list_head blocked_keys;
struct list_head local_codecs;
+ struct list_head sci_groups;
struct hci_dev_stats stat;
@@ -2082,6 +2091,12 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
#define mws_transport_config_capable(dev) (((dev)->commands[30] & 0x08) && \
(!hci_test_quirk((dev), HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG)))
+/* Shorter Connection Intervals support */
+#define le_sci_capable(dev) \
+ ((dev)->le_features[9] & HCI_LE_SCI)
+
+void hci_sci_groups_clear(struct hci_dev *hdev);
+
/* ----- HCI protocols ----- */
#define HCI_PROTO_DEFER 0x01
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c46c1236ebfa..04c5559ef029 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2543,8 +2543,9 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
INIT_LIST_HEAD(&hdev->adv_instances);
INIT_LIST_HEAD(&hdev->blocked_keys);
INIT_LIST_HEAD(&hdev->monitored_devices);
-
INIT_LIST_HEAD(&hdev->local_codecs);
+ INIT_LIST_HEAD(&hdev->sci_groups);
+
INIT_WORK(&hdev->rx_work, hci_rx_work);
INIT_WORK(&hdev->cmd_work, hci_cmd_work);
INIT_WORK(&hdev->tx_work, hci_tx_work);
@@ -2740,6 +2741,16 @@ void hci_unregister_dev(struct hci_dev *hdev)
}
EXPORT_SYMBOL(hci_unregister_dev);
+void hci_sci_groups_clear(struct hci_dev *hdev)
+{
+ struct sci_group *grp, *tmp;
+
+ list_for_each_entry_safe(grp, tmp, &hdev->sci_groups, list) {
+ list_del(&grp->list);
+ kfree(grp);
+ }
+}
+
/* Release HCI device */
void hci_release_dev(struct hci_dev *hdev)
{
@@ -2766,6 +2777,7 @@ void hci_release_dev(struct hci_dev *hdev)
hci_discovery_filter_clear(hdev);
hci_blocked_keys_clear(hdev);
hci_codec_list_clear(&hdev->local_codecs);
+ hci_sci_groups_clear(hdev);
msft_release(hdev);
hci_dev_unlock(hdev);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index eea2f810aafa..a73c5dad27cd 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3957,6 +3957,49 @@ static u8 hci_cc_le_read_all_local_features(struct hci_dev *hdev, void *data,
return rp->status;
}
+static u8 hci_cc_le_read_conn_interval(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_rp_le_read_conn_interval *rp = data;
+ __u8 i;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
+
+ if (rp->status)
+ return rp->status;
+
+ hci_dev_lock(hdev);
+
+ /* Clear any existing SCI groups before adding new ones. */
+ hci_sci_groups_clear(hdev);
+
+ for (i = 0; i < rp->num_grps; i++) {
+ struct hci_le_conn_interval_group *grp;
+ struct sci_group *sgrp;
+
+ /* Pull HCI event data for the current group. */
+ grp = skb_pull_data(skb, sizeof(*grp));
+ if (!grp) {
+ bt_dev_err(hdev, "invalid data length for SCI group");
+ break;
+ }
+
+ sgrp = kzalloc(sizeof(*sgrp), GFP_KERNEL);
+ if (!sgrp)
+ break;
+
+ sgrp->min = __le16_to_cpu(grp->min);
+ sgrp->max = __le16_to_cpu(grp->max);
+ sgrp->stride = __le16_to_cpu(grp->stride);
+
+ list_add(&sgrp->list, &hdev->sci_groups);
+ }
+
+ hci_dev_unlock(hdev);
+
+ return rp->status;
+}
+
static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
{
bt_dev_dbg(hdev, "status 0x%2.2x", status);
@@ -4239,6 +4282,10 @@ static const struct hci_cc {
HCI_CC(HCI_OP_LE_READ_ALL_LOCAL_FEATURES,
hci_cc_le_read_all_local_features,
sizeof(struct hci_rp_le_read_all_local_features)),
+ HCI_CC_VL(HCI_OP_LE_READ_CONN_INTERVAL,
+ hci_cc_le_read_conn_interval,
+ sizeof(struct hci_rp_le_read_conn_interval),
+ HCI_MAX_EVENT_SIZE),
};
static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
@@ -7372,6 +7419,16 @@ static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev,
hci_dev_unlock(hdev);
}
+static void hci_le_conn_rate_change_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_le_conn_rate_change *ev = data;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
+
+ /* TODO: Store rate to be used for next connection? */
+}
+
#define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
[_op] = { \
.func = _func, \
@@ -7483,6 +7540,9 @@ static const struct hci_le_ev {
sizeof(struct
hci_evt_le_read_all_remote_features_complete),
HCI_MAX_EVENT_SIZE),
+ /* [0x37 = HCI_EVT_LE_CONN_RATE_CHANGE] */
+ HCI_LE_EV(HCI_EVT_LE_CONN_RATE_CHANGE, hci_le_conn_rate_change_evt,
+ sizeof(struct hci_evt_le_conn_rate_change)),
};
static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index fd3aacdea512..3225bea38215 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4449,6 +4449,10 @@ static int hci_le_set_event_mask_sync(struct hci_dev *hdev)
events[6] |= 0x02; /* LE CS Subevent Result Continue event */
events[6] |= 0x04; /* LE CS Test End Complete event */
}
+
+ if (le_sci_capable(hdev))
+ events[6] |= 0x40; /* LE Connection Rate Change */
+
return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK,
sizeof(events), events, HCI_CMD_TIMEOUT);
}
@@ -4611,9 +4615,16 @@ static int hci_le_set_host_features_sync(struct hci_dev *hdev)
return err;
}
- if (le_cs_capable(hdev))
+ if (le_cs_capable(hdev)) {
/* Channel Sounding (Host Support) */
err = hci_le_set_host_feature_sync(hdev, 47, 0x01);
+ if (err)
+ return err;
+ }
+
+ if (le_sci_capable(hdev))
+ /* Short Connection Interval (Host Support) */
+ err = hci_le_set_host_feature_sync(hdev, 73, 0x01);
return err;
}
@@ -4896,11 +4907,81 @@ static int hci_le_set_default_phy_sync(struct hci_dev *hdev)
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
+/* Read Connection Interval if command is supported and SCI feature bit is
+ * marked as supported.
+ */
+static int hci_le_read_conn_interval_sync(struct hci_dev *hdev)
+{
+ if (!(hdev->commands[48] & BIT(7)) || !le_sci_capable(hdev))
+ return 0;
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_CONN_INTERVAL,
+ 0, NULL, HCI_CMD_TIMEOUT);
+}
+
+/* Set Default Connection Rate Parameters if command is supported, SCI feature
+ * bit is marked as supported and at least one of the supported SCI groups
+ * exists.
+ */
+static int hci_le_set_def_rate_sync(struct hci_dev *hdev)
+{
+ struct hci_cp_le_set_def_rate cp;
+ struct sci_group *grp, *tmp;
+ __u16 min = 0, max = 0;
+
+ if (!(hdev->commands[48] & BIT(6)) || !le_sci_capable(hdev) ||
+ list_empty(&hdev->sci_groups))
+ return 0;
+
+ memset(&cp, 0, sizeof(cp));
+
+ /* Iterate over the SCI groups and find the widest supported connection
+ * interval range to maximize compatibility with peer devices.
+ */
+ list_for_each_entry_safe(grp, tmp, &hdev->sci_groups, list) {
+ if (!min || grp->min < min)
+ min = grp->min;
+
+ if (!max || grp->max > max)
+ max = grp->max;
+ }
+
+ cp.interval_min = cpu_to_le16(min);
+ cp.interval_max = cpu_to_le16(max);
+
+ /* HOG 1.2 Table 7.4. Modes with recommended parameter values suggests
+ * subrate 1-4 for all modes so use that as default.
+ */
+ cp.subrate_min = cpu_to_le16(0x0001);
+ cp.subrate_max = cpu_to_le16(0x0004);
+
+ /* HIP 1.2 Table 7.5. Modes with recommended parameter values suggests
+ * max latency of 0 for all modes expect low power.
+ */
+ cp.max_latency = 0x0000;
+
+ /* HIP 1.2 Table 7.5. Modes with recommended parameter values suggests
+ * continuation number 1 for full range.
+ */
+ cp.cont_num = cpu_to_le16(0x0001);
+
+ cp.supv_timeout = hdev->le_supv_timeout;
+ cp.min_ce_len = cpu_to_le16(min);
+ cp.max_ce_len = cpu_to_le16(max);
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEF_RATE,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
static const struct hci_init_stage le_init4[] = {
/* HCI_OP_LE_WRITE_DEF_DATA_LEN */
HCI_INIT(hci_le_set_write_def_data_len_sync),
/* HCI_OP_LE_SET_DEFAULT_PHY */
HCI_INIT(hci_le_set_default_phy_sync),
+ /* HCI_OP_LE_READ_CONN_INTERVAL */
+ HCI_INIT(hci_le_read_conn_interval_sync),
+ /* HCI_OP_LE_SET_DEF_RATE */
+ HCI_INIT(hci_le_set_def_rate_sync),
{}
};
--
2.53.0
^ permalink raw reply related
* [PATCH v4 2/2] Bluetooth: MGMT: Add SCI setting bit(25)
From: Luiz Augusto von Dentz @ 2026-05-07 17:42 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260507174205.209488-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds MGMT_SETTING_SCI(25) which indicates that the controller is
support SCI feature.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci_core.h | 2 ++
include/net/bluetooth/mgmt.h | 1 +
net/bluetooth/mgmt.c | 6 ++++++
3 files changed, 9 insertions(+)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 61872403fe65..84a1ee798da1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2094,6 +2094,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
/* Shorter Connection Intervals support */
#define le_sci_capable(dev) \
((dev)->le_features[9] & HCI_LE_SCI)
+#define le_sci_enabled(dev) \
+ (le_enabled(dev) && le_sci_capable(dev))
void hci_sci_groups_clear(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 8234915854b6..dfd264f0bac7 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -121,6 +121,7 @@ struct mgmt_rp_read_index_list {
#define MGMT_SETTING_LL_PRIVACY BIT(22)
#define MGMT_SETTING_PAST_SENDER BIT(23)
#define MGMT_SETTING_PAST_RECEIVER BIT(24)
+#define MGMT_SETTING_SCI BIT(25)
#define MGMT_OP_READ_INFO 0x0004
#define MGMT_READ_INFO_SIZE 0
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index b05bb380e5f8..1ea06ae1efdc 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -864,6 +864,9 @@ static u32 get_supported_settings(struct hci_dev *hdev)
if (past_receiver_capable(hdev))
settings |= MGMT_SETTING_PAST_RECEIVER;
+ if (le_sci_capable(hdev))
+ settings |= MGMT_SETTING_SCI;
+
settings |= MGMT_SETTING_PHY_CONFIGURATION;
return settings;
@@ -955,6 +958,9 @@ static u32 get_current_settings(struct hci_dev *hdev)
if (past_receiver_enabled(hdev))
settings |= MGMT_SETTING_PAST_RECEIVER;
+ if (le_sci_enabled(hdev))
+ settings |= MGMT_SETTING_SCI;
+
return settings;
}
--
2.53.0
^ permalink raw reply related
* RE: [BlueZ] client/btpclient: Add BTP_EV_GAP_SEC_LEVEL_CHANGED support
From: bluez.test.bot @ 2026-05-07 17:50 UTC (permalink / raw)
To: linux-bluetooth, frederic.danis
In-Reply-To: <20260507161633.437600-1-frederic.danis@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 826 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091167
---Test result---
Test Summary:
CheckPatch PASS 0.44 seconds
GitLint PASS 0.29 seconds
BuildEll PASS 20.26 seconds
BluezMake PASS 652.26 seconds
CheckSmatch PASS 351.90 seconds
bluezmakeextell PASS 183.13 seconds
IncrementalBuild PASS 657.53 seconds
ScanBuild PASS 1021.35 seconds
https://github.com/bluez/bluez/pull/2106
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH BlueZ] bap: Fix typo in QoS D-Bus dictionary entry names
From: patchwork-bot+bluetooth @ 2026-05-07 17:50 UTC (permalink / raw)
To: Thomas Kirschner; +Cc: linux-bluetooth
In-Reply-To: <20260506230051.27436-1-thomaskirschner85@yahoo.de>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 7 May 2026 01:00:51 +0200 you wrote:
> MinimumDelay and PreferredMinimumDelay had wrong spelling, causing
> them to be exposed incorrectly over D-Bus. Any client relying on
> the correct spelling would fail to find these entries, breaking
> LE Audio QoS negotiation.
> ---
> profiles/audio/bap.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Here is the summary with links:
- [BlueZ] bap: Fix typo in QoS D-Bus dictionary entry names
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d45fd43a1cc3
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH BlueZ v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -48 Packet Antenna: 1 Step 2 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -60 ToA_ToD: 0xffffff45 Packet Antenna: 1 Step 3 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -54 ToA_ToD: 0xffffff53 Packet Antenna: 1
From: Prathibha Madugonde @ 2026-05-07 18:07 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
---
monitor/att.c | 521 ++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 500 insertions(+), 21 deletions(-)
diff --git a/monitor/att.c b/monitor/att.c
index 03d46634f..c8915ab04 100644
--- a/monitor/att.c
+++ b/monitor/att.c
@@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
print_field(" Segment Index: %u", segment_index);
}
-static void print_ras_ranging_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
{
uint16_t ranging_counter_config;
uint8_t selected_tx_power;
uint8_t antenna_paths_mask;
uint8_t mask;
+ uint8_t num_antenna_paths = 0;
+ uint8_t i;
if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
print_text(COLOR_ERROR, " Ranging Header: invalid size");
- return;
+ return 0;
}
/* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
@@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
print_text(COLOR_ERROR, " Selected TX Power: invalid size");
- return;
+ return 0;
}
print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
- return;
+ return 0;
}
print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
@@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (mask)
print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
+
+ /* Count the number of set bits in antenna_paths_mask */
+ for (i = 0; i < 4; i++) {
+ if (antenna_paths_mask & (1 << i))
+ num_antenna_paths++;
+ }
+
+ return num_antenna_paths;
}
static const char *ras_ranging_done_status_str(uint8_t status)
@@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
}
}
-static void print_ras_subevent_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
{
uint16_t start_acl_conn_event;
uint16_t freq_compensation;
@@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
print_text(COLOR_ERROR,
" Start ACL Connection Event: invalid size");
- return;
+ return 0;
}
print_field(" Start ACL Connection Event: %u",
@@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
print_text(COLOR_ERROR,
" Frequency Compensation: invalid size");
- return;
+ return 0;
}
print_field(" Frequency Compensation: %d (0.01 ppm)",
@@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
print_text(COLOR_ERROR, " Status: invalid size");
- return;
+ return 0;
}
ranging_done_status = status_byte1 & 0x0F;
@@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
print_text(COLOR_ERROR, " Abort Reasons: invalid size");
- return;
+ return 0;
}
ranging_abort_reason = status_byte2 & 0x0F;
@@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
print_text(COLOR_ERROR,
" Reference Power Level: invalid size");
- return;
+ return 0;
}
print_field(" Reference Power Level: %d dBm",
@@ -4273,10 +4283,460 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
print_text(COLOR_ERROR,
" Number of Steps Reported: invalid size");
- return;
+ return 0;
}
print_field(" Number of Steps Reported: %u", num_steps_reported);
+
+ return num_steps_reported;
+}
+
+static const char *packet_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "CS Access Address check is successful, and all bits "
+ "match the expected sequence";
+ case 0x01:
+ return "CS Access Address check is successful, but some bits "
+ "do not match the expected sequence";
+ case 0x02:
+ return "CS Access Address check failed";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "Tone quality is high";
+ case 0x01:
+ return "Tone quality is medium";
+ case 0x02:
+ return "Tone quality is low";
+ case 0x03:
+ return "Tone quality indication is not available";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_extension_str(uint8_t quality)
+{
+ switch ((quality >> 4) & 0x03) {
+ case 0x00:
+ return "Not tone extension slot";
+ case 0x01:
+ return "Tone extension slot; tone not expected to be present";
+ case 0x02:
+ return "Tone extension slot; tone expected to be present";
+ default:
+ return "Reserved";
+ }
+}
+
+static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, rssi, antenna;
+ uint16_t freq_offset;
+
+ if (len < 3) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR,
+ " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ if (len == 5) {
+ if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
+ print_text(COLOR_ERROR,
+ " Measured Freq Offset: invalid size");
+ return;
+ }
+
+ print_field(" Measured Freq Offset: %d (0.01 ppm)",
+ (int16_t)freq_offset);
+ }
+}
+
+static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+}
+
+static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t quality;
+
+ if (len < 1) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(quality),
+ quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(quality),
+ (quality >> 4) & 0x03);
+ }
+}
+
+static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t tone_quality;
+
+ /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ /* Parse Mode 1 data first */
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid size");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid size");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid size");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ /* Now parse Mode 2 data */
+ if (frame->size < 1)
+ return;
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ tone_quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(tone_quality),
+ tone_quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(tone_quality),
+ (tone_quality >> 4) & 0x03);
+ }
+}
+
+static void print_ranging_steps(const struct l2cap_frame *frame,
+ uint8_t num_steps, uint8_t num_antenna_paths)
+{
+ uint8_t step_idx;
+
+ for (step_idx = 0; step_idx < num_steps && frame->size > 0;
+ step_idx++) {
+ uint8_t mode_byte;
+ uint8_t mode_type;
+ bool aborted;
+ uint8_t step_data_len;
+
+ if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
+ print_text(COLOR_ERROR,
+ " Step %u: Mode: invalid size",
+ step_idx);
+ return;
+ }
+
+ mode_type = mode_byte & 0x03;
+ aborted = (mode_byte & 0x80) != 0;
+
+ print_field(" Step %u", step_idx);
+ print_field(" Mode Type: %u", mode_type);
+ print_field(" Aborted: %s", aborted ? "Yes" : "No");
+
+ /* If aborted, step data length is 0 */
+ if (aborted)
+ continue;
+
+ /* Determine step data length based on mode type
+ * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
+ * (reflector)
+ * Mode 1: Always 6 bytes
+ * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
+ * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
+ * num_antenna_paths * 4 bytes
+ */
+ switch (mode_type) {
+ case 0:
+ /* Mode 0: Default to 3 bytes (reflector)
+ * Only use 5 bytes if we're the last step AND have
+ * exactly 5 bytes remaining
+ */
+ if (step_idx == num_steps - 1 && frame->size == 5) {
+ /* Initiator - last step with exactly 5 bytes */
+ step_data_len = 5;
+ } else if (frame->size >= 3) {
+ /* Reflector - default case */
+ step_data_len = 3;
+ } else {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 0");
+ return;
+ }
+ break;
+ case 1:
+ /* Mode 1: Always 6 bytes */
+ if (frame->size < 6) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 1");
+ return;
+ }
+ step_data_len = 6;
+ break;
+ case 2:
+ /* Mode 2: 1 byte antenna + num_antenna_paths * 4
+ * bytes per path
+ */
+ step_data_len = 1 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 2 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ case 3:
+ /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
+ * num_antenna_paths * 4 bytes
+ */
+ step_data_len = 7 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 3 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ default:
+ print_text(COLOR_ERROR, " Unknown mode type");
+ return;
+ }
+
+ if (step_data_len > frame->size) {
+ print_text(COLOR_ERROR,
+ " Invalid step data length");
+ return;
+ }
+
+ if (step_data_len > 0) {
+ struct l2cap_frame step_frame;
+
+ l2cap_frame_clone(&step_frame, frame);
+ step_frame.size = step_data_len;
+
+ switch (mode_type) {
+ case 0:
+ print_step_mode_0(&step_frame, step_data_len);
+ break;
+ case 1:
+ print_step_mode_1(&step_frame, step_data_len);
+ break;
+ case 2:
+ print_step_mode_2(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ case 3:
+ print_step_mode_3(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ }
+
+ if (!l2cap_frame_pull((void *)frame, frame,
+ step_data_len))
+ return;
+ }
+ }
}
static void ras_ranging_data_read(const struct l2cap_frame *frame)
@@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
print_ras_segmentation_header(seg_header);
first_segment = seg_header & 0x01;
-
/* Only try to decode headers if this is the first segment */
- if (first_segment && frame->size >= 6) {
+ if (first_segment && frame->size >= 4) {
+ uint8_t num_steps;
+ uint8_t num_antenna_paths;
+
print_field(" Ranging Data Body:");
- print_ras_ranging_header(frame);
+ num_antenna_paths = print_ras_ranging_header(frame);
/* Try to decode subevent header if enough data remains */
- if (frame->size >= 10) {
+ if (frame->size >= 8) {
print_field(" Subevent #0:");
- print_ras_subevent_header(frame);
+ num_steps = print_ras_subevent_header(frame);
+
+ /* Parse steps if we have num_steps and
+ * num_antenna_paths
+ */
+ if (num_steps > 0 && num_antenna_paths > 0 &&
+ frame->size > 0) {
+ print_ranging_steps((void *)frame, num_steps,
+ num_antenna_paths);
+ }
}
+ } else if (!first_segment && frame->size > 0) {
+ /* For continuation segments, we cannot reliably decode without
+ * full segment reassembly, as steps may be split across
+ * segments.
+ * Just show the raw data.
+ */
+ print_field(" Continuation Segment (raw data - requires "
+ "reassembly for proper decoding):");
+ print_hex_field(" Segment Data", frame->data, frame->size);
}
- if (frame->size > 0) {
- print_hex_field(" Remaining Ranging Data Segment", frame->data,
- frame->size);
- }
+ if (frame->size > 0 && first_segment)
+ print_hex_field(" Remaining Ranging Data Segment",
+ frame->data, frame->size);
done:
- if (frame->size)
+ if (frame->size && first_segment)
print_hex_field(" Remaining Data", frame->data, frame->size);
}
--
2.34.1
^ permalink raw reply related
* Re: [PATCH BlueZ v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check i...
From: Luiz Augusto von Dentz @ 2026-05-07 18:17 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, quic_mohamull, quic_hbandi, quic_anubhavg
In-Reply-To: <20260507180736.2990540-1-prathm@qti.qualcomm.com>
Hi Prathibha,
On Thu, May 7, 2026 at 2:07 PM Prathibha Madugonde
<prathibha.madugonde@oss.qualcomm.com> wrote:
Not sure what went wrong, but the commit subject is way too big. If
you are trying to add an example of decoded trace produced by these
changes add it in the commit description _after_ the first/subject
line e.g.:
monitor: Add decoding of CS step mode data
<example>
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> ---
> monitor/att.c | 521 ++++++++++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 500 insertions(+), 21 deletions(-)
>
> diff --git a/monitor/att.c b/monitor/att.c
> index 03d46634f..c8915ab04 100644
> --- a/monitor/att.c
> +++ b/monitor/att.c
> @@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
> print_field(" Segment Index: %u", segment_index);
> }
>
> -static void print_ras_ranging_header(const struct l2cap_frame *frame)
> +static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
> {
> uint16_t ranging_counter_config;
> uint8_t selected_tx_power;
> uint8_t antenna_paths_mask;
> uint8_t mask;
> + uint8_t num_antenna_paths = 0;
> + uint8_t i;
>
> if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
> print_text(COLOR_ERROR, " Ranging Header: invalid size");
> - return;
> + return 0;
> }
>
> /* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
> @@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
> print_text(COLOR_ERROR, " Selected TX Power: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
>
> if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
> print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
> @@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
>
> if (mask)
> print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
> +
> + /* Count the number of set bits in antenna_paths_mask */
> + for (i = 0; i < 4; i++) {
> + if (antenna_paths_mask & (1 << i))
> + num_antenna_paths++;
> + }
> +
> + return num_antenna_paths;
> }
>
> static const char *ras_ranging_done_status_str(uint8_t status)
> @@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
> }
> }
>
> -static void print_ras_subevent_header(const struct l2cap_frame *frame)
> +static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
> {
> uint16_t start_acl_conn_event;
> uint16_t freq_compensation;
> @@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
> print_text(COLOR_ERROR,
> " Start ACL Connection Event: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Start ACL Connection Event: %u",
> @@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
> print_text(COLOR_ERROR,
> " Frequency Compensation: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Frequency Compensation: %d (0.01 ppm)",
> @@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
> print_text(COLOR_ERROR, " Status: invalid size");
> - return;
> + return 0;
> }
>
> ranging_done_status = status_byte1 & 0x0F;
> @@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
> print_text(COLOR_ERROR, " Abort Reasons: invalid size");
> - return;
> + return 0;
> }
>
> ranging_abort_reason = status_byte2 & 0x0F;
> @@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
> print_text(COLOR_ERROR,
> " Reference Power Level: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Reference Power Level: %d dBm",
> @@ -4273,10 +4283,460 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
> print_text(COLOR_ERROR,
> " Number of Steps Reported: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Number of Steps Reported: %u", num_steps_reported);
> +
> + return num_steps_reported;
> +}
> +
> +static const char *packet_quality_str(uint8_t quality)
> +{
> + switch (quality & 0x03) {
> + case 0x00:
> + return "CS Access Address check is successful, and all bits "
> + "match the expected sequence";
> + case 0x01:
> + return "CS Access Address check is successful, but some bits "
> + "do not match the expected sequence";
> + case 0x02:
> + return "CS Access Address check failed";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static const char *tone_quality_str(uint8_t quality)
> +{
> + switch (quality & 0x03) {
> + case 0x00:
> + return "Tone quality is high";
> + case 0x01:
> + return "Tone quality is medium";
> + case 0x02:
> + return "Tone quality is low";
> + case 0x03:
> + return "Tone quality indication is not available";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static const char *tone_extension_str(uint8_t quality)
> +{
> + switch ((quality >> 4) & 0x03) {
> + case 0x00:
> + return "Not tone extension slot";
> + case 0x01:
> + return "Tone extension slot; tone not expected to be present";
> + case 0x02:
> + return "Tone extension slot; tone expected to be present";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
> +{
> + uint8_t quality, rssi, antenna;
> + uint16_t freq_offset;
> +
> + if (len < 3) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR,
> + " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR,
> + " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +
> + if (len == 5) {
> + if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
> + print_text(COLOR_ERROR,
> + " Measured Freq Offset: invalid size");
> + return;
> + }
> +
> + print_field(" Measured Freq Offset: %d (0.01 ppm)",
> + (int16_t)freq_offset);
> + }
> +}
> +
> +static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
> +{
> + uint8_t quality, nadm, rssi, antenna;
> + uint16_t toa_tod;
> +
> + if (len < 6) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR, " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
> + print_text(COLOR_ERROR, " Packet NADM: invalid");
> + return;
> + }
> +
> + if (nadm == 0xFF)
> + print_field(" Packet NADM: Unknown NADM (0xff)");
> + else
> + print_field(" Packet NADM: %u", nadm);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
> + print_text(COLOR_ERROR, " ToA_ToD: invalid");
> + return;
> + }
> +
> + print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR, " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +}
> +
> +static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
> + uint8_t num_antenna_paths)
> +{
> + uint8_t ant_perm_idx;
> + uint8_t i;
> + uint32_t pct;
> + uint16_t i_sample, q_sample;
> + uint8_t quality;
> +
> + if (len < 1) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
> + print_text(COLOR_ERROR, " Antenna Permutation Index: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Antenna Permutation Index: %u", ant_perm_idx);
> +
> + /* Use the antenna paths count from ranging header */
> + for (i = 0; i < (num_antenna_paths + 1); i++) {
> + if (frame->size < 4) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for path %u",
> + i);
> + return;
> + }
> +
> + if (!l2cap_frame_get_le24((void *)frame, &pct)) {
> + print_text(COLOR_ERROR, " PCT: invalid");
> + return;
> + }
> +
> + /* Extract 12-bit I and Q samples from 24-bit PCT */
> + i_sample = pct & 0x0FFF;
> + q_sample = (pct >> 12) & 0x0FFF;
> +
> + print_field(" Path %u", i);
> + print_field(" PCT: 0x%06x", pct);
> + print_field(" I: 0x%03x", i_sample);
> + print_field(" Q: 0x%03x", q_sample);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR,
> + " Tone quality indicator: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Tone quality indicator: 0x%02x",
> + quality);
> + print_field(" %s (0x%02x)",
> + tone_quality_str(quality),
> + quality & 0x03);
> + print_field(" %s (0x%02x)",
> + tone_extension_str(quality),
> + (quality >> 4) & 0x03);
> + }
> +}
> +
> +static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
> + uint8_t num_antenna_paths)
> +{
> + uint8_t quality, nadm, rssi, antenna;
> + uint16_t toa_tod;
> + uint8_t ant_perm_idx;
> + uint8_t i;
> + uint32_t pct;
> + uint16_t i_sample, q_sample;
> + uint8_t tone_quality;
> +
> + /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
> + if (len < 6) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + /* Parse Mode 1 data first */
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR, " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
> + print_text(COLOR_ERROR, " Packet NADM: invalid size");
> + return;
> + }
> +
> + if (nadm == 0xFF)
> + print_field(" Packet NADM: Unknown NADM (0xff)");
> + else
> + print_field(" Packet NADM: %u", nadm);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid size");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
> + print_text(COLOR_ERROR, " ToA_ToD: invalid size");
> + return;
> + }
> +
> + print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR, " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +
> + /* Now parse Mode 2 data */
> + if (frame->size < 1)
> + return;
> +
> + if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
> + print_text(COLOR_ERROR, " Antenna Permutation Index: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Antenna Permutation Index: %u", ant_perm_idx);
> +
> + /* Use the antenna paths count from ranging header */
> + for (i = 0; i < (num_antenna_paths + 1); i++) {
> + if (frame->size < 4) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for path %u",
> + i);
> + return;
> + }
> +
> + if (!l2cap_frame_get_le24((void *)frame, &pct)) {
> + print_text(COLOR_ERROR, " PCT: invalid");
> + return;
> + }
> +
> + /* Extract 12-bit I and Q samples from 24-bit PCT */
> + i_sample = pct & 0x0FFF;
> + q_sample = (pct >> 12) & 0x0FFF;
> +
> + print_field(" Path %u", i);
> + print_field(" PCT: 0x%06x", pct);
> + print_field(" I: 0x%03x", i_sample);
> + print_field(" Q: 0x%03x", q_sample);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
> + print_text(COLOR_ERROR,
> + " Tone quality indicator: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Tone quality indicator: 0x%02x",
> + tone_quality);
> + print_field(" %s (0x%02x)",
> + tone_quality_str(tone_quality),
> + tone_quality & 0x03);
> + print_field(" %s (0x%02x)",
> + tone_extension_str(tone_quality),
> + (tone_quality >> 4) & 0x03);
> + }
> +}
> +
> +static void print_ranging_steps(const struct l2cap_frame *frame,
> + uint8_t num_steps, uint8_t num_antenna_paths)
> +{
> + uint8_t step_idx;
> +
> + for (step_idx = 0; step_idx < num_steps && frame->size > 0;
> + step_idx++) {
> + uint8_t mode_byte;
> + uint8_t mode_type;
> + bool aborted;
> + uint8_t step_data_len;
> +
> + if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
> + print_text(COLOR_ERROR,
> + " Step %u: Mode: invalid size",
> + step_idx);
> + return;
> + }
> +
> + mode_type = mode_byte & 0x03;
> + aborted = (mode_byte & 0x80) != 0;
> +
> + print_field(" Step %u", step_idx);
> + print_field(" Mode Type: %u", mode_type);
> + print_field(" Aborted: %s", aborted ? "Yes" : "No");
> +
> + /* If aborted, step data length is 0 */
> + if (aborted)
> + continue;
> +
> + /* Determine step data length based on mode type
> + * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
> + * (reflector)
> + * Mode 1: Always 6 bytes
> + * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
> + * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
> + * num_antenna_paths * 4 bytes
> + */
> + switch (mode_type) {
> + case 0:
> + /* Mode 0: Default to 3 bytes (reflector)
> + * Only use 5 bytes if we're the last step AND have
> + * exactly 5 bytes remaining
> + */
> + if (step_idx == num_steps - 1 && frame->size == 5) {
> + /* Initiator - last step with exactly 5 bytes */
> + step_data_len = 5;
> + } else if (frame->size >= 3) {
> + /* Reflector - default case */
> + step_data_len = 3;
> + } else {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 0");
> + return;
> + }
> + break;
> + case 1:
> + /* Mode 1: Always 6 bytes */
> + if (frame->size < 6) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 1");
> + return;
> + }
> + step_data_len = 6;
> + break;
> + case 2:
> + /* Mode 2: 1 byte antenna + num_antenna_paths * 4
> + * bytes per path
> + */
> + step_data_len = 1 + ((num_antenna_paths + 1) * 4);
> + if (frame->size < step_data_len) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 2 (need %u)",
> + step_data_len);
> + return;
> + }
> + break;
> + case 3:
> + /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
> + * num_antenna_paths * 4 bytes
> + */
> + step_data_len = 7 + ((num_antenna_paths + 1) * 4);
> + if (frame->size < step_data_len) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 3 (need %u)",
> + step_data_len);
> + return;
> + }
> + break;
> + default:
> + print_text(COLOR_ERROR, " Unknown mode type");
> + return;
> + }
> +
> + if (step_data_len > frame->size) {
> + print_text(COLOR_ERROR,
> + " Invalid step data length");
> + return;
> + }
> +
> + if (step_data_len > 0) {
> + struct l2cap_frame step_frame;
> +
> + l2cap_frame_clone(&step_frame, frame);
> + step_frame.size = step_data_len;
> +
> + switch (mode_type) {
> + case 0:
> + print_step_mode_0(&step_frame, step_data_len);
> + break;
> + case 1:
> + print_step_mode_1(&step_frame, step_data_len);
> + break;
> + case 2:
> + print_step_mode_2(&step_frame, step_data_len,
> + num_antenna_paths);
> + break;
> + case 3:
> + print_step_mode_3(&step_frame, step_data_len,
> + num_antenna_paths);
> + break;
> + }
> +
> + if (!l2cap_frame_pull((void *)frame, frame,
> + step_data_len))
> + return;
> + }
> + }
> }
>
> static void ras_ranging_data_read(const struct l2cap_frame *frame)
> @@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
> print_ras_segmentation_header(seg_header);
>
> first_segment = seg_header & 0x01;
> -
> /* Only try to decode headers if this is the first segment */
> - if (first_segment && frame->size >= 6) {
> + if (first_segment && frame->size >= 4) {
> + uint8_t num_steps;
> + uint8_t num_antenna_paths;
> +
> print_field(" Ranging Data Body:");
> - print_ras_ranging_header(frame);
> + num_antenna_paths = print_ras_ranging_header(frame);
>
> /* Try to decode subevent header if enough data remains */
> - if (frame->size >= 10) {
> + if (frame->size >= 8) {
> print_field(" Subevent #0:");
> - print_ras_subevent_header(frame);
> + num_steps = print_ras_subevent_header(frame);
> +
> + /* Parse steps if we have num_steps and
> + * num_antenna_paths
> + */
> + if (num_steps > 0 && num_antenna_paths > 0 &&
> + frame->size > 0) {
> + print_ranging_steps((void *)frame, num_steps,
> + num_antenna_paths);
> + }
> }
> + } else if (!first_segment && frame->size > 0) {
> + /* For continuation segments, we cannot reliably decode without
> + * full segment reassembly, as steps may be split across
> + * segments.
> + * Just show the raw data.
> + */
> + print_field(" Continuation Segment (raw data - requires "
> + "reassembly for proper decoding):");
> + print_hex_field(" Segment Data", frame->data, frame->size);
> }
>
> - if (frame->size > 0) {
> - print_hex_field(" Remaining Ranging Data Segment", frame->data,
> - frame->size);
> - }
> + if (frame->size > 0 && first_segment)
> + print_hex_field(" Remaining Ranging Data Segment",
> + frame->data, frame->size);
>
> done:
> - if (frame->size)
> + if (frame->size && first_segment)
> print_hex_field(" Remaining Data", frame->data, frame->size);
> }
>
> --
> 2.34.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* [bluez/bluez] d45fd4: bap: Fix typo in QoS D-Bus dictionary entry names
From: qarnet @ 2026-05-07 18:25 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: d45fd43a1cc3ba791858f11c144112c518a9ad84
https://github.com/bluez/bluez/commit/d45fd43a1cc3ba791858f11c144112c518a9ad84
Author: Thomas Kirschner <thomaskirschner85@yahoo.de>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M profiles/audio/bap.c
Log Message:
-----------
bap: Fix typo in QoS D-Bus dictionary entry names
MinimumDelay and PreferredMinimumDelay had wrong spelling, causing
them to be exposed incorrectly over D-Bus. Any client relying on
the correct spelling would fail to find these entries, breaking
LE Audio QoS negotiation.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 27e1da: monitor: Add parsing of CS step mode data in RAS N...
From: prathibhamadugonde @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091197
Home: https://github.com/bluez/bluez
Commit: 27e1daee95cfa9081887153b978ec5a512c45945
https://github.com/bluez/bluez/commit/27e1daee95cfa9081887153b978ec5a512c45945
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Add parsing of CS step mode data in RAS Notifications
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 27dcd3: monitor: Add parsing of CS step mode data in RAS N...
From: prathibhamadugonde @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091217
Home: https://github.com/bluez/bluez
Commit: 27dcd34c10709dfa5aef33377d882a08538f811d
https://github.com/bluez/bluez/commit/27dcd34c10709dfa5aef33377d882a08538f811d
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -48 Packet Antenna: 1 Step 2 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -60 ToA_ToD: 0xffffff45 Packet Antenna: 1 Step 3 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -54 ToA_ToD: 0xffffff53 Packet Antenna: 1
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1090721
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* RE: Fixes/improvements for the PCI M.2 power sequencing driver
From: bluez.test.bot @ 2026-05-07 18:51 UTC (permalink / raw)
To: linux-bluetooth, manivannan.sadhasivam
In-Reply-To: <20260507-pwrseq-m2-bt-v2-1-1740bd478539@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 4895 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091159
---Test result---
Test Summary:
CheckPatch PASS 5.83 seconds
GitLint FAIL 2.49 seconds
SubjectPrefix FAIL 0.89 seconds
BuildKernel PASS 27.15 seconds
CheckAllWarning PASS 29.30 seconds
CheckSparse PASS 28.12 seconds
BuildKernel32 PASS 25.66 seconds
TestRunnerSetup PASS 566.63 seconds
TestRunner_l2cap-tester PASS 378.06 seconds
TestRunner_iso-tester PASS 594.73 seconds
TestRunner_bnep-tester PASS 18.80 seconds
TestRunner_mgmt-tester PASS 2022.73 seconds
TestRunner_rfcomm-tester PASS 63.46 seconds
TestRunner_sco-tester PASS 141.37 seconds
TestRunner_ioctl-tester PASS 133.16 seconds
TestRunner_mesh-tester PASS 59.66 seconds
TestRunner_smp-tester PASS 17.73 seconds
TestRunner_userchan-tester PASS 19.19 seconds
TestRunner_6lowpan-tester PASS 51.12 seconds
IncrementalBuild PASS 37.89 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2,2/9] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (83>80): "[v2,2/9] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices"
[v2,4/9] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (87>80): "[v2,4/9] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe"
[v2,5/9] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (86>80): "[v2,5/9] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table"
[v2,8/9] power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[v2,8/9] power: sequencing: Add an API to return the pwrseq device's 'dev' pointer"
[v2,9/9] Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (97>80): "[v2,9/9] Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector"
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
https://github.com/bluez/bluetooth-next/pull/153
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ,v1] monitor: Add parsing of CS step mode data in RAS Notifications
From: bluez.test.bot @ 2026-05-07 19:09 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260507171342.2971553-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 46779 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091197
---Test result---
Test Summary:
CheckPatch PASS 0.71 seconds
GitLint PASS 0.27 seconds
BuildEll PASS 18.32 seconds
BluezMake FAIL 622.01 seconds
MakeCheck FAIL 7.25 seconds
MakeDistcheck PASS 223.69 seconds
CheckValgrind FAIL 189.34 seconds
CheckSmatch FAIL 290.87 seconds
bluezmakeextell FAIL 159.72 seconds
IncrementalBuild FAIL 648.39 seconds
ScanBuild FAIL 394.98 seconds
Details
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%'
tools/sco-tester.c: note: in included file:
./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures
./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures
tools/bneptest.c:634:39: warning: unknown escape sequence: '\%'
tools/seq2bseq.c:57:26: warning: Variable length array is used.
tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/btpclient/gatt.c: note: in included file:
./src/shared/btp.h:328:41: warning: array of flexible structures
./src/shared/btp.h:333:55: warning: array of flexible structures
./src/shared/btp.h:356:47: warning: array of flexible structures
./src/shared/btp.h:385:42: warning: array of flexible structures
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
unit/avctp.c:505:34: warning: Variable length array is used.
unit/avctp.c:556:34: warning: Variable length array is used.
unit/test-avrcp.c:373:26: warning: Variable length array is used.
unit/test-avrcp.c:398:26: warning: Variable length array is used.
unit/test-avrcp.c:414:24: warning: Variable length array is used.
unit/avrcp-lib.c:1085:34: warning: Variable length array is used.
unit/avrcp-lib.c:1583:34: warning: Variable length array is used.
unit/avrcp-lib.c:1612:34: warning: Variable length array is used.
unit/avrcp-lib.c:1638:34: warning: Variable length array is used.
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/main.c: note: in included file (through src/device.h):
./src/shared/queue.h:19:20: error: redefinition of struct queue_entry
mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used.
client/display.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/packet.c:2000:26: warning: Variable length array is used.
monitor/packet.c: note: in included file:
monitor/bt.h:3909:52: warning: array of flexible structures
monitor/bt.h:3897:40: warning: array of flexible structures
monitor/msft.c: note: in included file:
monitor/msft.h:88:44: warning: array of flexible structures
tools/rctest.c:631:33: warning: non-ANSI function declaration of function 'automated_send_recv'
tools/hex2hcd.c:136:26: warning: Variable length array is used.
tools/meshctl.c:324:33: warning: non-ANSI function declaration of function 'forget_mesh_devices'
tools/mesh-gatt/node.c:456:39: warning: non-ANSI function declaration of function 'node_get_local_node'
tools/mesh-gatt/net.c:1239:30: warning: non-ANSI function declaration of function 'get_next_seq'
tools/mesh-gatt/net.c:2193:29: warning: non-ANSI function declaration of function 'net_get_default_ttl'
tools/mesh-gatt/net.c:2207:26: warning: non-ANSI function declaration of function 'net_get_seq_num'
tools/mesh-gatt/prov.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-gatt/onoff-model.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v1] monitor: Add parsing of CS step mode data in RAS Notifications
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 6)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read
i = execvp(cmdargv[0], cmdargv);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull'
i = execvp(cmdargv[0], cmdargv);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined
req.channel = raddr.rc_channel;
^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value
sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int'
uint32_t *value_int = malloc(sizeof(int));
~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value
free(allocArray[i]);
^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name'
return add_service(0, &si);
^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc'
return -1;
^~~~~~~~~
4 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read
len = write(sk, buf, invalid ? 2 : 3);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 4 + media_transport_size);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read
len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull'
tcp_port = atoi(optarg);
^~~~~~~~~~~~
tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull'
if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3))
^~~~~~~~~~~~~~
2 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
4 warnings generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read
argv += optind;
^ ~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read
argv -= optind;
^ ~~~~~~
1 warning generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read
ptr = fgets(result, sizeof(result), fp);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value
chr_write(chr, value, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_RDONLY | O_NOCTTY, 0);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read
bit = 0;
^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(cp->data, ad_data, ad_len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value
g_free(text[i]);
^~~~~~~~~~~~~~~
1 warning generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed
if (!cb->resume_cb)
^~~~~~~~~~~~~
profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream')
stream->starting = TRUE;
~~~~~~ ^
profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
if (!stream->suspending && stream->suspend_timer) {
^~~~~~~~~~~~~~~~~~
profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
stream->suspending = TRUE;
~~~~~~ ^
4 warnings generated.
profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read
operands += sizeof(*pdu);
^ ~~~~~~~~~~~~
1 warning generated.
attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write'
return prepare_write(long_write);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(to, from, count);
^~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
mesh/main.c:162:3: warning: Value stored to 'optarg' is never read
optarg += strlen("auto");
^ ~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/hci.c:97:4: warning: Value stored to 'ptr' is never read
ptr += sprintf(ptr, "%s", m->str);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
client/player.c:2363:8: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
if (!strcmp(ep->path, pattern))
^~~~~~~~~~~~~~~~~~~~~~~~~
client/player.c:3640:16: warning: Null pointer passed to 1st parameter expecting 'nonnull'
codec->name = strdup(name);
^~~~~~~~~~~~
2 warnings generated.
gdbus/watch.c:226:3: warning: Attempt to free released memory
g_free(l->data);
^~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/sdp.c:509:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:539:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1885:26: warning: Potential leak of memory pointed to by 'ap'
for (; pdlist; pdlist = pdlist->next) {
^~~~~~
lib/bluetooth/sdp.c:1899:6: warning: Potential leak of memory pointed to by 'pds'
ap = sdp_list_append(ap, pds);
~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1944:10: warning: Potential leak of memory pointed to by 'u'
*seqp = sdp_list_append(*seqp, u);
~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:2049:4: warning: Potential leak of memory pointed to by 'lang'
sdp_list_free(*langSeq, free);
^~~~~~~~~~~~~
lib/bluetooth/sdp.c:2138:9: warning: Potential leak of memory pointed to by 'profDesc'
return 0;
^
lib/bluetooth/sdp.c:3270:8: warning: Potential leak of memory pointed to by 'pSvcRec'
pSeq = sdp_list_append(pSeq, pSvcRec);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:3271:9: warning: Potential leak of memory pointed to by 'pSeq'
pdata += sizeof(uint32_t);
~~~~~~^~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:4607:13: warning: Potential leak of memory pointed to by 'rec_list'
} while (scanned < attr_list_len && pdata_len > 0);
^~~~~~~
lib/bluetooth/sdp.c:4903:40: warning: Potential leak of memory pointed to by 'tseq'
for (d = sdpdata->val.dataseq; d; d = d->next) {
^
lib/bluetooth/sdp.c:4939:8: warning: Potential leak of memory pointed to by 'subseq'
tseq = sdp_list_append(tseq, subseq);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
monitor/l2cap.c:1676:4: warning: Value stored to 'data' is never read
data += len;
^ ~~~
monitor/l2cap.c:1677:4: warning: Value stored to 'size' is never read
size -= len;
^ ~~~
2 warnings generated.
monitor/hwdb.c:59:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:64:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
monitor/hwdb.c:106:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:111:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
4 warnings generated.
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
https://github.com/bluez/bluez/pull/2107
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
From: bluez.test.bot @ 2026-05-07 19:11 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260507180736.2990540-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 48238 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091217
---Test result---
Test Summary:
CheckPatch PASS 0.75 seconds
GitLint FAIL 0.29 seconds
BuildEll PASS 20.32 seconds
BluezMake FAIL 634.48 seconds
MakeCheck FAIL 7.84 seconds
MakeDistcheck PASS 247.55 seconds
CheckValgrind FAIL 202.16 seconds
CheckSmatch FAIL 324.56 seconds
bluezmakeextell FAIL 171.75 seconds
IncrementalBuild FAIL 632.89 seconds
ScanBuild FAIL 423.81 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (255>80): "[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c"
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%'
tools/sco-tester.c: note: in included file:
./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures
./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures
tools/bneptest.c:634:39: warning: unknown escape sequence: '\%'
tools/seq2bseq.c:57:26: warning: Variable length array is used.
tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/btpclient/gatt.c: note: in included file:
./src/shared/btp.h:328:41: warning: array of flexible structures
./src/shared/btp.h:333:55: warning: array of flexible structures
./src/shared/btp.h:356:47: warning: array of flexible structures
./src/shared/btp.h:385:42: warning: array of flexible structures
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
unit/avctp.c:505:34: warning: Variable length array is used.
unit/avctp.c:556:34: warning: Variable length array is used.
unit/test-avrcp.c:373:26: warning: Variable length array is used.
unit/test-avrcp.c:398:26: warning: Variable length array is used.
unit/test-avrcp.c:414:24: warning: Variable length array is used.
unit/avrcp-lib.c:1085:34: warning: Variable length array is used.
unit/avrcp-lib.c:1583:34: warning: Variable length array is used.
unit/avrcp-lib.c:1612:34: warning: Variable length array is used.
unit/avrcp-lib.c:1638:34: warning: Variable length array is used.
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/main.c: note: in included file (through src/device.h):
./src/shared/queue.h:19:20: error: redefinition of struct queue_entry
mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used.
client/display.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/packet.c:2000:26: warning: Variable length array is used.
monitor/packet.c: note: in included file:
monitor/bt.h:3909:52: warning: array of flexible structures
monitor/bt.h:3897:40: warning: array of flexible structures
monitor/msft.c: note: in included file:
monitor/msft.h:88:44: warning: array of flexible structures
tools/rctest.c:631:33: warning: non-ANSI function declaration of function 'automated_send_recv'
tools/hex2hcd.c:136:26: warning: Variable length array is used.
tools/meshctl.c:324:33: warning: non-ANSI function declaration of function 'forget_mesh_devices'
tools/mesh-gatt/node.c:456:39: warning: non-ANSI function declaration of function 'node_get_local_node'
tools/mesh-gatt/net.c:1239:30: warning: non-ANSI function declaration of function 'get_next_seq'
tools/mesh-gatt/net.c:2193:29: warning: non-ANSI function declaration of function 'net_get_default_ttl'
tools/mesh-gatt/net.c:2207:26: warning: non-ANSI function declaration of function 'net_get_seq_num'
tools/mesh-gatt/prov.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-gatt/onoff-model.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
ell/log.c:431:65: warning: non-ANSI function declaration of function 'register_debug_section'
ell/log.c:439:68: warning: non-ANSI function declaration of function 'free_debug_sections'
ell/random.c:60:42: warning: non-ANSI function declaration of function 'l_getrandom_is_supported'
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 6)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read
i = execvp(cmdargv[0], cmdargv);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull'
i = execvp(cmdargv[0], cmdargv);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined
req.channel = raddr.rc_channel;
^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value
sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int'
uint32_t *value_int = malloc(sizeof(int));
~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value
free(allocArray[i]);
^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name'
return add_service(0, &si);
^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc'
return -1;
^~~~~~~~~
4 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read
len = write(sk, buf, invalid ? 2 : 3);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 4 + media_transport_size);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read
len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull'
tcp_port = atoi(optarg);
^~~~~~~~~~~~
tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull'
if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3))
^~~~~~~~~~~~~~
2 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
4 warnings generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read
argv += optind;
^ ~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read
argv -= optind;
^ ~~~~~~
1 warning generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read
ptr = fgets(result, sizeof(result), fp);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value
chr_write(chr, value, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_RDONLY | O_NOCTTY, 0);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read
bit = 0;
^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(cp->data, ad_data, ad_len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value
g_free(text[i]);
^~~~~~~~~~~~~~~
1 warning generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed
if (!cb->resume_cb)
^~~~~~~~~~~~~
profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream')
stream->starting = TRUE;
~~~~~~ ^
profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
if (!stream->suspending && stream->suspend_timer) {
^~~~~~~~~~~~~~~~~~
profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
stream->suspending = TRUE;
~~~~~~ ^
4 warnings generated.
profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read
operands += sizeof(*pdu);
^ ~~~~~~~~~~~~
1 warning generated.
attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write'
return prepare_write(long_write);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(to, from, count);
^~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
mesh/main.c:162:3: warning: Value stored to 'optarg' is never read
optarg += strlen("auto");
^ ~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/hci.c:97:4: warning: Value stored to 'ptr' is never read
ptr += sprintf(ptr, "%s", m->str);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
client/player.c:2363:8: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
if (!strcmp(ep->path, pattern))
^~~~~~~~~~~~~~~~~~~~~~~~~
client/player.c:3640:16: warning: Null pointer passed to 1st parameter expecting 'nonnull'
codec->name = strdup(name);
^~~~~~~~~~~~
2 warnings generated.
gdbus/watch.c:226:3: warning: Attempt to free released memory
g_free(l->data);
^~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/sdp.c:509:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:539:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1885:26: warning: Potential leak of memory pointed to by 'ap'
for (; pdlist; pdlist = pdlist->next) {
^~~~~~
lib/bluetooth/sdp.c:1899:6: warning: Potential leak of memory pointed to by 'pds'
ap = sdp_list_append(ap, pds);
~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1944:10: warning: Potential leak of memory pointed to by 'u'
*seqp = sdp_list_append(*seqp, u);
~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:2049:4: warning: Potential leak of memory pointed to by 'lang'
sdp_list_free(*langSeq, free);
^~~~~~~~~~~~~
lib/bluetooth/sdp.c:2138:9: warning: Potential leak of memory pointed to by 'profDesc'
return 0;
^
lib/bluetooth/sdp.c:3270:8: warning: Potential leak of memory pointed to by 'pSvcRec'
pSeq = sdp_list_append(pSeq, pSvcRec);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:3271:9: warning: Potential leak of memory pointed to by 'pSeq'
pdata += sizeof(uint32_t);
~~~~~~^~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:4607:13: warning: Potential leak of memory pointed to by 'rec_list'
} while (scanned < attr_list_len && pdata_len > 0);
^~~~~~~
lib/bluetooth/sdp.c:4903:40: warning: Potential leak of memory pointed to by 'tseq'
for (d = sdpdata->val.dataseq; d; d = d->next) {
^
lib/bluetooth/sdp.c:4939:8: warning: Potential leak of memory pointed to by 'subseq'
tseq = sdp_list_append(tseq, subseq);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
monitor/l2cap.c:1676:4: warning: Value stored to 'data' is never read
data += len;
^ ~~~
monitor/l2cap.c:1677:4: warning: Value stored to 'size' is never read
size -= len;
^ ~~~
2 warnings generated.
monitor/hwdb.c:59:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:64:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
monitor/hwdb.c:106:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:111:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
4 warnings generated.
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
https://github.com/bluez/bluez/pull/2108
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [Bug 221481] New: btintel_pcie: suspend fails with -EBUSY on Intel Lunar Lake (s2idle)
From: bugzilla-daemon @ 2026-05-07 19:28 UTC (permalink / raw)
To: linux-bluetooth
https://bugzilla.kernel.org/show_bug.cgi?id=221481
Bug ID: 221481
Summary: btintel_pcie: suspend fails with -EBUSY on Intel Lunar
Lake (s2idle)
Product: Drivers
Version: 2.5
Hardware: Intel
OS: Linux
Status: NEW
Severity: blocking
Priority: P3
Component: Bluetooth
Assignee: linux-bluetooth@vger.kernel.org
Reporter: vladko@duck.com
Regression: No
Summary:
btintel_pcie returns -16 (EBUSY) during suspend, causing the entire suspend
operation to abort on Intel Lunar Lake hardware. The system immediately resumes
after every suspend attempt.
Hardware:
- CPU/Platform: Intel Lunar Lake
- Bluetooth device: btintel_pcie at PCI 0000:00:14.7
- iGPU: Intel Arc 140V (xe driver)
Software
- Kernel: 6.19.13-arch1-1
- Distribution: EndeavourOS (Arch-based)
- Desktop: KDE Plasma (Wayland)
- Sleep state: s2idle only (mem_sleep shows [s2idle], no S3/deep)
Reproduction
1. Boot system with btintel_pcie loaded
2. Run: systemctl suspend
3. System immediately wakes up; suspend never enters sleep state
Kernel log (relevant excerpt)
kernel: PM: suspend entry (s2idle)
kernel: btintel_pcie 0000:00:14.7: PM: pci_pm_suspend(): btintel_pcie_suspend
[btintel_pcie] returns -16
kernel: btintel_pcie 0000:00:14.7: PM: dpm_run_callback(): pci_pm_suspend
returns -16
kernel: btintel_pcie 0000:00:14.7: PM: failed to suspend async: error -16
kernel: PM: Some devices failed to suspend, or early wake event detected
kernel: PM: suspend exit
systemd-sleep: Failed to put system to sleep. System resumed again: Device or
resource busy
Workaround
Manually unloading the module before suspend allows sleep to succeed:
modprobe -r btintel_pcie && systemctl suspend
Expected behavior
btintel_pcie should successfully suspend alongside the rest of the system
during
s2idle, or yield gracefully so the suspend proceeds without it.
Notes
/sys/power/mem_sleep reports [s2idle] only (no deep/S3), consistent with
Lunar Lake's lack of S3 support. The issue is reproducible 100% of the time
with the module loaded.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* [PATCH] Bluetooth: btintel_pcie: fix stale cache in set_dxstate fallback check
From: Vladimir V. Kondratyev @ 2026-05-07 20:34 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Chandrashekar Devegowda, Kiran K, Paul Menzel, Arnd Bergmann,
linux-bluetooth, linux-kernel, Vladimir V. Kondratyev
btintel_pcie_set_dxstate() falls back to checking the controller state via
btintel_pcie_in_d3/d0() when the alive interrupt is missed. However, these
helpers read boot_stage_cache, which is only updated by the interrupt
handler. As such, if the interrupt was missed, the cache is stale and the
fallback check always fails, exhausting all retries and returning -EBUSY,
causing suspend to abort.
The fix involves re-reading the hardware register before the fallback state
check, consistent with btintel_pcie_resume().
Fixes: e57362f4911b ("Bluetooth: btintel_pcie: Add support for _suspend() / _resume()")
Signed-off-by: Vladimir V. Kondratyev <vladimirkondratyev2@gmail.com>
---
drivers/bluetooth/btintel_pcie.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index fda474406003..7fca8eea6e01 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2778,9 +2778,13 @@ static int btintel_pcie_set_dxstate(struct btintel_pcie_data *data, u32 dxstate)
BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0);
/* A hardware bug may cause the alive interrupt to be missed.
- * Check if the controller reached the expected state and retry
- * the operation only if it hasn't.
+ * Refresh boot_stage_cache from hardware since it is only
+ * updated by the interrupt handler, then check if the
+ * controller reached the expected state and retry the
+ * operation only if it hasn't.
*/
+ data->boot_stage_cache = btintel_pcie_rd_reg32(data,
+ BTINTEL_PCIE_CSR_BOOT_STAGE_REG);
if (dxstate == BTINTEL_PCIE_STATE_D0) {
if (btintel_pcie_in_d0(data))
return 0;
--
2.54.0
^ permalink raw reply related
* Re: (subset) [PATCH v3 00/10] Fix up WCN6855 RFA power supply name
From: Bjorn Andersson @ 2026-05-07 20:34 UTC (permalink / raw)
To: Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Balakrishna Godavarthi, Rocky Liao,
Bartosz Golaszewski, Konrad Dybcio
Cc: Luiz Augusto von Dentz, linux-arm-msm, linux-bluetooth,
devicetree, linux-kernel, Konrad Dybcio, Krzysztof Kozlowski,
Abel Vesa, Bartosz Golaszewski, Dmitry Baryshkov
In-Reply-To: <20260225-topic-wcn6855_pmu_dtbdings-v3-0-576ec5c4e631@oss.qualcomm.com>
On Wed, 25 Feb 2026 13:23:20 +0100, Konrad Dybcio wrote:
> Commit 5f4f954bba12 ("dt-bindings: bluetooth: bring the HW description
> closer to reality for wcn6855") renamed the supply representing the
> VDD17_PMU_RFA leg to mention "1p8" instead.
>
> While the supply's voltage is normally 1.8 V, the bindings should
> reflect the actual naming of the pin. Moreover, almost all DTs define
> the output as 1p7, so that ends up looking a little odd..
>
> [...]
Applied, thanks!
[02/10] arm64: dts: qcom: qcs615-ride: Fix BT RFA supply name
commit: 244e064bc8ce848d40fe13451b6096a66b2bbdb2
[03/10] arm64: dts: qcom: sc8280xp-crd: Fix BT RFA supply name
commit: d28f68b052780b945c35996d02adf2426ed0bff7
[04/10] arm64: dts: qcom: sc8280xp-gaokun3: Fix BT RFA supply name
commit: fa99d3af7edb8acd735e861446477afd64007af7
[05/10] arm64: dts: qcom: sc8280xp-x13s: Fix BT RFA supply name
commit: de1a7dc3ccda556bef52185ae1d65ebb900b2925
[06/10] arm64: dts: qcom: sc8280xp-blackrock: Fix BT RFA supply name
commit: a25cd984f4078cb772179787cf78790bbcc2c543
[07/10] arm64: dts: qcom: sm8450-hdk: Fix BT RFA supply name
commit: 557a49f764306ccf8155ca19970be78d90f8d3de
[08/10] arm64: dts: qcom: x1-omnibook-x14: Fix BT RFA supply name
commit: e5a38ea7633853433295106650d008c1428d4d0e
[09/10] arm64: dts: qcom: x1-zenbook-a14: Fix BT RFA supply name
commit: 8be58b9b8a10ac276d4058c66ebd6b2b9e5aa683
[10/10] arm64: dts: qcom: lemans-ride-common: Fix up WCN power grid
commit: d859095bcafc4c5e26c551350d2327aeb2e08e59
Best regards,
--
Bjorn Andersson <andersson@kernel.org>
^ permalink raw reply
* RE: [v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature
From: bluez.test.bot @ 2026-05-07 20:38 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260507174205.209488-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2137 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091208
---Test result---
Test Summary:
CheckPatch PASS 2.66 seconds
GitLint FAIL 0.57 seconds
SubjectPrefix PASS 0.22 seconds
BuildKernel PASS 26.44 seconds
CheckAllWarning PASS 28.96 seconds
CheckSparse PASS 27.68 seconds
BuildKernel32 PASS 25.19 seconds
TestRunnerSetup PASS 560.65 seconds
TestRunner_l2cap-tester PASS 377.96 seconds
TestRunner_iso-tester PASS 593.01 seconds
TestRunner_bnep-tester PASS 18.45 seconds
TestRunner_mgmt-tester PASS 2034.02 seconds
TestRunner_rfcomm-tester PASS 74.65 seconds
TestRunner_sco-tester PASS 141.23 seconds
TestRunner_ioctl-tester PASS 133.55 seconds
TestRunner_mesh-tester PASS 59.86 seconds
TestRunner_smp-tester PASS 17.97 seconds
TestRunner_userchan-tester PASS 19.24 seconds
TestRunner_6lowpan-tester PASS 51.22 seconds
IncrementalBuild PASS 42.05 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature"
https://github.com/bluez/bluetooth-next/pull/154
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Bluetooth: btintel_pcie: fix stale cache in set_dxstate fallback check
From: bluez.test.bot @ 2026-05-07 21:06 UTC (permalink / raw)
To: linux-bluetooth, vladimirkondratyev2
In-Reply-To: <20260507203426.128975-1-vladimirkondratyev2@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091276
---Test result---
Test Summary:
CheckPatch PASS 0.69 seconds
GitLint PASS 0.30 seconds
SubjectPrefix PASS 0.11 seconds
BuildKernel PASS 27.57 seconds
CheckAllWarning PASS 30.23 seconds
CheckSparse PASS 28.95 seconds
BuildKernel32 PASS 27.07 seconds
TestRunnerSetup PASS 582.94 seconds
IncrementalBuild PASS 25.20 seconds
https://github.com/bluez/bluetooth-next/pull/155
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH BlueZ v3] monitor: Parsing of cs step mode data in RAS Notifications
From: Prathibha Madugonde @ 2026-05-08 5:38 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Sample Decoding Example:
Subevent #0:
Start ACL Connection Event: 406
Frequency Compensation: -16384 (0.01 ppm)
Ranging Done Status: Partial results, more to follow (0x1)
Subevent Done Status: All results complete (0x0)
Ranging Abort Reason: No abort (0x0)
Subevent Abort Reason: No abort (0x0)
Reference Power Level: -14 dBm
Number of Steps Reported: 58
Step 0
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -52
Packet Antenna: 1
Step 1
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -48
Packet Antenna: 1
Step 2
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -60
ToA_ToD: 0xffffff45
Packet Antenna: 1
Step 3
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -54
ToA_ToD: 0xffffff53
Packet Antenna: 1
---
monitor/att.c | 523 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 501 insertions(+), 22 deletions(-)
diff --git a/monitor/att.c b/monitor/att.c
index 03d46634f..278ac5675 100644
--- a/monitor/att.c
+++ b/monitor/att.c
@@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
print_field(" Segment Index: %u", segment_index);
}
-static void print_ras_ranging_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
{
uint16_t ranging_counter_config;
uint8_t selected_tx_power;
uint8_t antenna_paths_mask;
uint8_t mask;
+ uint8_t num_antenna_paths = 0;
+ uint8_t i;
if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
print_text(COLOR_ERROR, " Ranging Header: invalid size");
- return;
+ return 0;
}
/* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
@@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
print_text(COLOR_ERROR, " Selected TX Power: invalid size");
- return;
+ return 0;
}
print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
- return;
+ return 0;
}
print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
@@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (mask)
print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
+
+ /* Count the number of set bits in antenna_paths_mask */
+ for (i = 0; i < 4; i++) {
+ if (antenna_paths_mask & (1 << i))
+ num_antenna_paths++;
+ }
+
+ return num_antenna_paths;
}
static const char *ras_ranging_done_status_str(uint8_t status)
@@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
}
}
-static void print_ras_subevent_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
{
uint16_t start_acl_conn_event;
uint16_t freq_compensation;
@@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
print_text(COLOR_ERROR,
" Start ACL Connection Event: invalid size");
- return;
+ return 0;
}
print_field(" Start ACL Connection Event: %u",
@@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
print_text(COLOR_ERROR,
" Frequency Compensation: invalid size");
- return;
+ return 0;
}
print_field(" Frequency Compensation: %d (0.01 ppm)",
@@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
print_text(COLOR_ERROR, " Status: invalid size");
- return;
+ return 0;
}
ranging_done_status = status_byte1 & 0x0F;
@@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
print_text(COLOR_ERROR, " Abort Reasons: invalid size");
- return;
+ return 0;
}
ranging_abort_reason = status_byte2 & 0x0F;
@@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
print_text(COLOR_ERROR,
" Reference Power Level: invalid size");
- return;
+ return 0;
}
print_field(" Reference Power Level: %d dBm",
@@ -4273,16 +4283,466 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
print_text(COLOR_ERROR,
" Number of Steps Reported: invalid size");
- return;
+ return 0;
}
print_field(" Number of Steps Reported: %u", num_steps_reported);
+
+ return num_steps_reported;
+}
+
+static const char *packet_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "CS Access Address check is successful, and all bits "
+ "match the expected sequence";
+ case 0x01:
+ return "CS Access Address check is successful, but some bits "
+ "do not match the expected sequence";
+ case 0x02:
+ return "CS Access Address check failed";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "Tone quality is high";
+ case 0x01:
+ return "Tone quality is medium";
+ case 0x02:
+ return "Tone quality is low";
+ case 0x03:
+ return "Tone quality indication is not available";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_extension_str(uint8_t quality)
+{
+ switch ((quality >> 4) & 0x03) {
+ case 0x00:
+ return "Not tone extension slot";
+ case 0x01:
+ return "Tone extension slot; tone not expected to be present";
+ case 0x02:
+ return "Tone extension slot; tone expected to be present";
+ default:
+ return "Reserved";
+ }
+}
+
+static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, rssi, antenna;
+ uint16_t freq_offset;
+
+ if (len < 3) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR,
+ " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ if (len == 5) {
+ if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
+ print_text(COLOR_ERROR,
+ " Measured Freq Offset: invalid size");
+ return;
+ }
+
+ print_field(" Measured Freq Offset: %d (0.01 ppm)",
+ (int16_t)freq_offset);
+ }
+}
+
+static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+}
+
+static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t quality;
+
+ if (len < 1) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(quality),
+ quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(quality),
+ (quality >> 4) & 0x03);
+ }
+}
+
+static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t tone_quality;
+
+ /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ /* Parse Mode 1 data first */
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid size");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid size");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid size");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ /* Now parse Mode 2 data */
+ if (frame->size < 1)
+ return;
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ tone_quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(tone_quality),
+ tone_quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(tone_quality),
+ (tone_quality >> 4) & 0x03);
+ }
+}
+
+static void print_ranging_steps(const struct l2cap_frame *frame,
+ uint8_t num_steps, uint8_t num_antenna_paths)
+{
+ uint8_t step_idx;
+
+ for (step_idx = 0; step_idx < num_steps && frame->size > 0;
+ step_idx++) {
+ uint8_t mode_byte;
+ uint8_t mode_type;
+ bool aborted;
+ uint8_t step_data_len;
+
+ if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
+ print_text(COLOR_ERROR,
+ " Step %u: Mode: invalid size",
+ step_idx);
+ return;
+ }
+
+ mode_type = mode_byte & 0x03;
+ aborted = (mode_byte & 0x80) != 0;
+
+ print_field(" Step %u", step_idx);
+ print_field(" Mode Type: %u", mode_type);
+ print_field(" Aborted: %s", aborted ? "Yes" : "No");
+
+ /* If aborted, step data length is 0 */
+ if (aborted)
+ continue;
+
+ /* Determine step data length based on mode type
+ * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
+ * (reflector)
+ * Mode 1: Always 6 bytes
+ * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
+ * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
+ * num_antenna_paths * 4 bytes
+ */
+ switch (mode_type) {
+ case 0:
+ /* Mode 0: Default to 3 bytes (reflector)
+ * Only use 5 bytes if we're the last step AND have
+ * exactly 5 bytes remaining
+ */
+ if (step_idx == num_steps - 1 && frame->size == 5) {
+ /* Initiator - last step with exactly 5 bytes */
+ step_data_len = 5;
+ } else if (frame->size >= 3) {
+ /* Reflector - default case */
+ step_data_len = 3;
+ } else {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 0");
+ return;
+ }
+ break;
+ case 1:
+ /* Mode 1: Always 6 bytes */
+ if (frame->size < 6) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 1");
+ return;
+ }
+ step_data_len = 6;
+ break;
+ case 2:
+ /* Mode 2: 1 byte antenna + num_antenna_paths * 4
+ * bytes per path
+ */
+ step_data_len = 1 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 2 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ case 3:
+ /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
+ * num_antenna_paths * 4 bytes
+ */
+ step_data_len = 7 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 3 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ default:
+ print_text(COLOR_ERROR, " Unknown mode type");
+ return;
+ }
+
+ if (step_data_len > frame->size) {
+ print_text(COLOR_ERROR,
+ " Invalid step data length");
+ return;
+ }
+
+ if (step_data_len > 0) {
+ struct l2cap_frame step_frame;
+
+ l2cap_frame_clone(&step_frame, frame);
+ step_frame.size = step_data_len;
+
+ switch (mode_type) {
+ case 0:
+ print_step_mode_0(&step_frame, step_data_len);
+ break;
+ case 1:
+ print_step_mode_1(&step_frame, step_data_len);
+ break;
+ case 2:
+ print_step_mode_2(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ case 3:
+ print_step_mode_3(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ }
+
+ if (!l2cap_frame_pull((void *)frame, frame,
+ step_data_len))
+ return;
+ }
+ }
}
static void ras_ranging_data_read(const struct l2cap_frame *frame)
{
uint8_t seg_header;
- bool first_segment;
+ bool first_segment = true;
if (!l2cap_frame_get_u8((void *)frame, &seg_header)) {
print_text(COLOR_ERROR, " Segmentation Header: invalid size");
@@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
print_ras_segmentation_header(seg_header);
first_segment = seg_header & 0x01;
-
/* Only try to decode headers if this is the first segment */
- if (first_segment && frame->size >= 6) {
+ if (first_segment && frame->size >= 4) {
+ uint8_t num_steps;
+ uint8_t num_antenna_paths;
+
print_field(" Ranging Data Body:");
- print_ras_ranging_header(frame);
+ num_antenna_paths = print_ras_ranging_header(frame);
/* Try to decode subevent header if enough data remains */
- if (frame->size >= 10) {
+ if (frame->size >= 8) {
print_field(" Subevent #0:");
- print_ras_subevent_header(frame);
+ num_steps = print_ras_subevent_header(frame);
+
+ /* Parse steps if we have num_steps and
+ * num_antenna_paths
+ */
+ if (num_steps > 0 && num_antenna_paths > 0 &&
+ frame->size > 0) {
+ print_ranging_steps((void *)frame, num_steps,
+ num_antenna_paths);
+ }
}
+ } else if (!first_segment && frame->size > 0) {
+ /* For continuation segments, we cannot reliably decode without
+ * full segment reassembly, as steps may be split across
+ * segments.
+ * Just show the raw data.
+ */
+ print_field(" Continuation Segment (raw data - requires "
+ "reassembly for proper decoding):");
+ print_hex_field(" Segment Data", frame->data, frame->size);
}
- if (frame->size > 0) {
- print_hex_field(" Remaining Ranging Data Segment", frame->data,
- frame->size);
- }
+ if (frame->size > 0 && first_segment)
+ print_hex_field(" Remaining Ranging Data Segment",
+ frame->data, frame->size);
done:
- if (frame->size)
+ if (frame->size && first_segment)
print_hex_field(" Remaining Data", frame->data, frame->size);
}
--
2.34.1
^ permalink raw reply related
* [bluez/bluez] b1528e: monitor: Parsing of cs step mode data in RAS Notif...
From: prathibhamadugonde @ 2026-05-08 6:13 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091417
Home: https://github.com/bluez/bluez
Commit: b1528e37b53e3743947e22bdd4376bac225ba5b3
https://github.com/bluez/bluez/commit/b1528e37b53e3743947e22bdd4376bac225ba5b3
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-08 (Fri, 08 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Parsing of cs step mode data in RAS Notifications
Sample Decoding Example:
Subevent #0:
Start ACL Connection Event: 406
Frequency Compensation: -16384 (0.01 ppm)
Ranging Done Status: Partial results, more to follow (0x1)
Subevent Done Status: All results complete (0x0)
Ranging Abort Reason: No abort (0x0)
Subevent Abort Reason: No abort (0x0)
Reference Power Level: -14 dBm
Number of Steps Reported: 58
Step 0
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -52
Packet Antenna: 1
Step 1
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -48
Packet Antenna: 1
Step 2
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -60
ToA_ToD: 0xffffff45
Packet Antenna: 1
Step 3
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -54
ToA_ToD: 0xffffff53
Packet Antenna: 1
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* RE: [BlueZ,v3] monitor: Parsing of cs step mode data in RAS Notifications
From: bluez.test.bot @ 2026-05-08 7:09 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260508053819.3424918-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 989 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091417
---Test result---
Test Summary:
CheckPatch PASS 0.66 seconds
GitLint PASS 0.23 seconds
BuildEll PASS 20.00 seconds
BluezMake PASS 653.56 seconds
MakeCheck PASS 0.88 seconds
MakeDistcheck PASS 243.78 seconds
CheckValgrind PASS 220.27 seconds
CheckSmatch PASS 346.56 seconds
bluezmakeextell PASS 181.41 seconds
IncrementalBuild PASS 647.01 seconds
ScanBuild PASS 1010.36 seconds
https://github.com/bluez/bluez/pull/2109
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: virtio_bt: fix potential memory leak in virtbt_probe()
From: Abdun Nihaal @ 2026-05-08 8:41 UTC (permalink / raw)
To: marcel; +Cc: Abdun Nihaal, luiz.dentz, linux-bluetooth, linux-kernel, stable
The memory allocated for struct virtio_bluetooth is not freed on the
error paths. Fix that by calling kfree() on the error paths.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.
drivers/bluetooth/virtio_bt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..b34dd5ddd631 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)
err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
if (err)
- return err;
+ goto free_vbt;
hdev = hci_alloc_dev();
if (!hdev) {
@@ -400,6 +400,8 @@ static int virtbt_probe(struct virtio_device *vdev)
hci_free_dev(hdev);
failed:
vdev->config->del_vqs(vdev);
+free_vbt:
+ kfree(vbt);
return err;
}
--
2.43.0
^ permalink raw reply related
* RE: Bluetooth: virtio_bt: fix potential memory leak in virtbt_probe()
From: bluez.test.bot @ 2026-05-08 10:16 UTC (permalink / raw)
To: linux-bluetooth, nihaal
In-Reply-To: <20260508084158.68765-1-nihaal@cse.iitm.ac.in>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091511
---Test result---
Test Summary:
CheckPatch PASS 0.64 seconds
GitLint PASS 0.23 seconds
SubjectPrefix PASS 0.08 seconds
BuildKernel PASS 26.45 seconds
CheckAllWarning PASS 29.08 seconds
CheckSparse PASS 27.49 seconds
BuildKernel32 PASS 25.44 seconds
TestRunnerSetup PASS 572.35 seconds
IncrementalBuild PASS 24.73 seconds
https://github.com/bluez/bluetooth-next/pull/156
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Bluetooth: RFCOMM: missing sock_hold() in rfcomm_get_sock_by_channel()
From: y2k @ 2026-05-08 11:53 UTC (permalink / raw)
To: marcel; +Cc: luiz.dentz, linux-bluetooth, linux-kernel
Commit 4e37f6452d58 ("Bluetooth: SCO: hold sk properly in sco_conn_ready")
fixed a UAF in SCO by adding sock_hold() before returning a socket pointer
from sco_get_sock_listen(). The RFCOMM counterpart has the same problem.
rfcomm_get_sock_by_channel() returns a socket pointer without holding a
reference. The caller rfcomm_connect_ind() then calls lock_sock() on the
returned pointer:
parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
if (!parent)
return 0;
lock_sock(parent); /* UAF if parent was freed */
rfcomm_get_sock_by_channel() holds read_lock(&rfcomm_sk_list.lock) during
the search but releases it before returning. Between the return and the
lock_sock() call, the socket can be closed and freed by another thread
since rfcomm_sock_release() does not take rfcomm_lock().
rfcomm_connect_ind() is called under rfcomm_lock() but the socket close
path does not take rfcomm_lock(), so there is no mutual exclusion.
The race condition is:
Thread 1 (rfcomm_connect_ind) Thread 2 (rfcomm_sock_release)
rfcomm_get_sock_by_channel()
returns parent (no sock_hold)
__rfcomm_sock_close()
SOCK_ZAPPED set
sock_orphan() -> sk_socket = NULL
rfcomm_sock_kill()
sock_put() -> refcount=0 -> FREE
lock_sock(parent) <- UAF
The fix should mirror 4e37f6452d58: add sock_hold() before returning
the socket in rfcomm_get_sock_by_channel(), and sock_put() after
lock_sock() in rfcomm_connect_ind().
Fixes: b7ce436a5d79 ("Bluetooth: switch to lock_sock in RFCOMM")
Reported-by: y2k <y2k@desarrollaria.com>
Thanks,
y2k
y2k@desarrollaria.com
^ permalink raw reply
* Re: [PATCH v2 0/9] Fixes/improvements for the PCI M.2 power sequencing driver
From: Wei Deng @ 2026-05-08 12:49 UTC (permalink / raw)
To: manivannan.sadhasivam, Bartosz Golaszewski, Manivannan Sadhasivam,
Marcel Holtmann, Luiz Augusto von Dentz, Shuai Zhang
Cc: linux-pm, linux-kernel, linux-pci, linux-arm-msm, linux-bluetooth,
Luiz Augusto von Dentz, Konrad Dybcio, Bartosz Golaszewski,
Dmitry Baryshkov
In-Reply-To: <20260507-pwrseq-m2-bt-v2-0-1740bd478539@oss.qualcomm.com>
Hi Mani,
Tested with WCN685x on both M.2 card (pwrseq-pcie-m2) and direct attach
(pwrseq-qcom-wcn). BT works correctly in both cases.
Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
On 5/8/2026 12:06 AM, Manivannan Sadhasivam via B4 Relay wrote:
> Hi,
>
> This series has several key improvements and fixes to the M.2 power sequencing
> driver and also the BT HCI_QCA driver. Notably, this series allows the M.2 power
> sequencing driver to work with more M.2 cards, not just WCN7850. It also allows
> the BT HCI_QCA driver to detect whether it can control BT_EN (or W_DISABLE2#)
> signal on the connector and set the HCI_QUIRK_NON_PERSISTENT_SETUP quirk.
>
> Testing
> =======
>
> This series was tested on Lenovo Thinkpad T14s together with the below DTS
> patches:
> https://github.com/Mani-Sadhasivam/linux/commit/29534d15307551b2355eb254601dec511169f0aa
> https://github.com/Mani-Sadhasivam/linux/commit/f4eaacfe647674be200847092b43cdef2194fc55
>
> Merge Strategy
> ==============
>
> Since the BT HCI_QCA changes depend on the pwrseq changes, it would be good to
> merge the whole series through pwrseq tree or through an immutable branch.
>
> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
> ---
> Changes in v2:
> - Dropped the pwrseq_is_fixed() change in favor or exporting pwrseq device's dev
> pointer and using it to check for the presence of W_DISABLE2# property
> - Dropped the BT_EN fix for the Qcom WCN devices since it will be handled
> separately
> - Collected tags
> - Link to v1: https://patch.msgid.link/20260422-pwrseq-m2-bt-v1-0-720d02545a64@oss.qualcomm.com
>
> ---
> Manivannan Sadhasivam (9):
> power: sequencing: pcie-m2: Fix inconsistent function prefixes
> power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
> power: sequencing: pcie-m2: Improve PCI device ID check
> power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
> power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
> Bluetooth: hci_qca: Add M.2 Bluetooth device support using pwrseq
> Bluetooth: hci_qca: Rename 'power_ctrl_enabled' to 'bt_en_available'
> power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
> Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector
>
> drivers/bluetooth/hci_qca.c | 28 +++-
> drivers/power/sequencing/core.c | 9 ++
> drivers/power/sequencing/pwrseq-pcie-m2.c | 234 ++++++++++++++++++++++--------
> include/linux/pwrseq/consumer.h | 7 +
> 4 files changed, 217 insertions(+), 61 deletions(-)
> ---
> base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
> change-id: 20260422-pwrseq-m2-bt-abdaa71094eb
>
> Best regards,
> --
> Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
>
>
--
Best Regards,
Wei Deng
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox