* [PATCH] Bluetooth: btmtk: handle FUNC_CTRL events without status field
From: Mikhail Gavrilov @ 2026-05-08 17:31 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Johan Hedberg, Tristan Madani, linux-bluetooth, linux-kernel,
stable, Mikhail Gavrilov
A WMT FUNC_CTRL response shorter than struct btmtk_hci_wmt_evt_funcc
(9 bytes; WMT header plus a 2-byte big-endian status) makes
btmtk_usb_hci_wmt_sync() fail with -EINVAL. This regresses Bluetooth
initialization on MediaTek MT7922 (e.g. USB id 0489:e0e2; reproduced
with firmware 0x008a008a, build 20260224103448): the FUNC_CTRL response
from the controller is 7 bytes long and the second skb_pull_data() in
the FUNC_CTRL case returns NULL, aborting setup:
Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20260224103448
Bluetooth: hci0: Failed to send wmt func ctrl (-22)
Reverting the offending commit on top of v7.1-rc2 restores Bluetooth
on the affected hardware.
The pre-existing code dereferenced wmt_evt_funcc->status out of the
SKB tailroom in this case -- the original out-of-bounds read that the
offending commit correctly closes. The byte pair read OOB almost
never matched 0x404 (ON_DONE) or 0x420 (ON_PROGRESS), so the else
branch ran and the caller observed BTMTK_WMT_ON_UNDONE. That value
lets btmtk_usb_setup() proceed: for func_query it means "not yet
enabled, issue enable", and for the enable command it means "treat
as not done", both of which keep setup advancing rather than aborting
it.
Preserve that effective behaviour explicitly: when the status field
is absent, set status to BTMTK_WMT_ON_UNDONE instead of failing.
The OOB read remains closed, since skb_pull_data() still validates
the length before any further access.
Fixes: 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB length before struct access")
Cc: stable@vger.kernel.org
Cc: Tristan Madani <tristan@talencesecurity.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> # MT7922 (0489:e0e2)
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
---
drivers/bluetooth/btmtk.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index f70c1b0f8990..fb4875760164 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -719,8 +719,10 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
case BTMTK_WMT_FUNC_CTRL:
if (!skb_pull_data(data->evt_skb,
sizeof(wmt_evt_funcc->status))) {
- err = -EINVAL;
- goto err_free_skb;
+ bt_dev_dbg(hdev,
+ "FUNC_CTRL event without status, assuming UNDONE");
+ status = BTMTK_WMT_ON_UNDONE;
+ break;
}
wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v2 0/9] Fixes/improvements for the PCI M.2 power sequencing driver
From: Wei Deng @ 2026-05-08 12:49 UTC (permalink / raw)
To: manivannan.sadhasivam, Bartosz Golaszewski, Manivannan Sadhasivam,
Marcel Holtmann, Luiz Augusto von Dentz, Shuai Zhang
Cc: linux-pm, linux-kernel, linux-pci, linux-arm-msm, linux-bluetooth,
Luiz Augusto von Dentz, Konrad Dybcio, Bartosz Golaszewski,
Dmitry Baryshkov
In-Reply-To: <20260507-pwrseq-m2-bt-v2-0-1740bd478539@oss.qualcomm.com>
Hi Mani,
Tested with WCN685x on both M.2 card (pwrseq-pcie-m2) and direct attach
(pwrseq-qcom-wcn). BT works correctly in both cases.
Tested-by: Wei Deng <wei.deng@oss.qualcomm.com>
On 5/8/2026 12:06 AM, Manivannan Sadhasivam via B4 Relay wrote:
> Hi,
>
> This series has several key improvements and fixes to the M.2 power sequencing
> driver and also the BT HCI_QCA driver. Notably, this series allows the M.2 power
> sequencing driver to work with more M.2 cards, not just WCN7850. It also allows
> the BT HCI_QCA driver to detect whether it can control BT_EN (or W_DISABLE2#)
> signal on the connector and set the HCI_QUIRK_NON_PERSISTENT_SETUP quirk.
>
> Testing
> =======
>
> This series was tested on Lenovo Thinkpad T14s together with the below DTS
> patches:
> https://github.com/Mani-Sadhasivam/linux/commit/29534d15307551b2355eb254601dec511169f0aa
> https://github.com/Mani-Sadhasivam/linux/commit/f4eaacfe647674be200847092b43cdef2194fc55
>
> Merge Strategy
> ==============
>
> Since the BT HCI_QCA changes depend on the pwrseq changes, it would be good to
> merge the whole series through pwrseq tree or through an immutable branch.
>
> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
> ---
> Changes in v2:
> - Dropped the pwrseq_is_fixed() change in favor or exporting pwrseq device's dev
> pointer and using it to check for the presence of W_DISABLE2# property
> - Dropped the BT_EN fix for the Qcom WCN devices since it will be handled
> separately
> - Collected tags
> - Link to v1: https://patch.msgid.link/20260422-pwrseq-m2-bt-v1-0-720d02545a64@oss.qualcomm.com
>
> ---
> Manivannan Sadhasivam (9):
> power: sequencing: pcie-m2: Fix inconsistent function prefixes
> power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
> power: sequencing: pcie-m2: Improve PCI device ID check
> power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
> power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
> Bluetooth: hci_qca: Add M.2 Bluetooth device support using pwrseq
> Bluetooth: hci_qca: Rename 'power_ctrl_enabled' to 'bt_en_available'
> power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
> Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector
>
> drivers/bluetooth/hci_qca.c | 28 +++-
> drivers/power/sequencing/core.c | 9 ++
> drivers/power/sequencing/pwrseq-pcie-m2.c | 234 ++++++++++++++++++++++--------
> include/linux/pwrseq/consumer.h | 7 +
> 4 files changed, 217 insertions(+), 61 deletions(-)
> ---
> base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
> change-id: 20260422-pwrseq-m2-bt-abdaa71094eb
>
> Best regards,
> --
> Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
>
>
--
Best Regards,
Wei Deng
^ permalink raw reply
* Bluetooth: RFCOMM: missing sock_hold() in rfcomm_get_sock_by_channel()
From: y2k @ 2026-05-08 11:53 UTC (permalink / raw)
To: marcel; +Cc: luiz.dentz, linux-bluetooth, linux-kernel
Commit 4e37f6452d58 ("Bluetooth: SCO: hold sk properly in sco_conn_ready")
fixed a UAF in SCO by adding sock_hold() before returning a socket pointer
from sco_get_sock_listen(). The RFCOMM counterpart has the same problem.
rfcomm_get_sock_by_channel() returns a socket pointer without holding a
reference. The caller rfcomm_connect_ind() then calls lock_sock() on the
returned pointer:
parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
if (!parent)
return 0;
lock_sock(parent); /* UAF if parent was freed */
rfcomm_get_sock_by_channel() holds read_lock(&rfcomm_sk_list.lock) during
the search but releases it before returning. Between the return and the
lock_sock() call, the socket can be closed and freed by another thread
since rfcomm_sock_release() does not take rfcomm_lock().
rfcomm_connect_ind() is called under rfcomm_lock() but the socket close
path does not take rfcomm_lock(), so there is no mutual exclusion.
The race condition is:
Thread 1 (rfcomm_connect_ind) Thread 2 (rfcomm_sock_release)
rfcomm_get_sock_by_channel()
returns parent (no sock_hold)
__rfcomm_sock_close()
SOCK_ZAPPED set
sock_orphan() -> sk_socket = NULL
rfcomm_sock_kill()
sock_put() -> refcount=0 -> FREE
lock_sock(parent) <- UAF
The fix should mirror 4e37f6452d58: add sock_hold() before returning
the socket in rfcomm_get_sock_by_channel(), and sock_put() after
lock_sock() in rfcomm_connect_ind().
Fixes: b7ce436a5d79 ("Bluetooth: switch to lock_sock in RFCOMM")
Reported-by: y2k <y2k@desarrollaria.com>
Thanks,
y2k
y2k@desarrollaria.com
^ permalink raw reply
* RE: Bluetooth: virtio_bt: fix potential memory leak in virtbt_probe()
From: bluez.test.bot @ 2026-05-08 10:16 UTC (permalink / raw)
To: linux-bluetooth, nihaal
In-Reply-To: <20260508084158.68765-1-nihaal@cse.iitm.ac.in>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091511
---Test result---
Test Summary:
CheckPatch PASS 0.64 seconds
GitLint PASS 0.23 seconds
SubjectPrefix PASS 0.08 seconds
BuildKernel PASS 26.45 seconds
CheckAllWarning PASS 29.08 seconds
CheckSparse PASS 27.49 seconds
BuildKernel32 PASS 25.44 seconds
TestRunnerSetup PASS 572.35 seconds
IncrementalBuild PASS 24.73 seconds
https://github.com/bluez/bluetooth-next/pull/156
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: virtio_bt: fix potential memory leak in virtbt_probe()
From: Abdun Nihaal @ 2026-05-08 8:41 UTC (permalink / raw)
To: marcel; +Cc: Abdun Nihaal, luiz.dentz, linux-bluetooth, linux-kernel, stable
The memory allocated for struct virtio_bluetooth is not freed on the
error paths. Fix that by calling kfree() on the error paths.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.
drivers/bluetooth/virtio_bt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..b34dd5ddd631 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)
err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
if (err)
- return err;
+ goto free_vbt;
hdev = hci_alloc_dev();
if (!hdev) {
@@ -400,6 +400,8 @@ static int virtbt_probe(struct virtio_device *vdev)
hci_free_dev(hdev);
failed:
vdev->config->del_vqs(vdev);
+free_vbt:
+ kfree(vbt);
return err;
}
--
2.43.0
^ permalink raw reply related
* RE: [BlueZ,v3] monitor: Parsing of cs step mode data in RAS Notifications
From: bluez.test.bot @ 2026-05-08 7:09 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260508053819.3424918-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 989 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091417
---Test result---
Test Summary:
CheckPatch PASS 0.66 seconds
GitLint PASS 0.23 seconds
BuildEll PASS 20.00 seconds
BluezMake PASS 653.56 seconds
MakeCheck PASS 0.88 seconds
MakeDistcheck PASS 243.78 seconds
CheckValgrind PASS 220.27 seconds
CheckSmatch PASS 346.56 seconds
bluezmakeextell PASS 181.41 seconds
IncrementalBuild PASS 647.01 seconds
ScanBuild PASS 1010.36 seconds
https://github.com/bluez/bluez/pull/2109
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez] b1528e: monitor: Parsing of cs step mode data in RAS Notif...
From: prathibhamadugonde @ 2026-05-08 6:13 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091417
Home: https://github.com/bluez/bluez
Commit: b1528e37b53e3743947e22bdd4376bac225ba5b3
https://github.com/bluez/bluez/commit/b1528e37b53e3743947e22bdd4376bac225ba5b3
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-08 (Fri, 08 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Parsing of cs step mode data in RAS Notifications
Sample Decoding Example:
Subevent #0:
Start ACL Connection Event: 406
Frequency Compensation: -16384 (0.01 ppm)
Ranging Done Status: Partial results, more to follow (0x1)
Subevent Done Status: All results complete (0x0)
Ranging Abort Reason: No abort (0x0)
Subevent Abort Reason: No abort (0x0)
Reference Power Level: -14 dBm
Number of Steps Reported: 58
Step 0
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -52
Packet Antenna: 1
Step 1
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -48
Packet Antenna: 1
Step 2
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -60
ToA_ToD: 0xffffff45
Packet Antenna: 1
Step 3
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -54
ToA_ToD: 0xffffff53
Packet Antenna: 1
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v3] monitor: Parsing of cs step mode data in RAS Notifications
From: Prathibha Madugonde @ 2026-05-08 5:38 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Sample Decoding Example:
Subevent #0:
Start ACL Connection Event: 406
Frequency Compensation: -16384 (0.01 ppm)
Ranging Done Status: Partial results, more to follow (0x1)
Subevent Done Status: All results complete (0x0)
Ranging Abort Reason: No abort (0x0)
Subevent Abort Reason: No abort (0x0)
Reference Power Level: -14 dBm
Number of Steps Reported: 58
Step 0
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -52
Packet Antenna: 1
Step 1
Mode Type: 0
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet RSSI: -48
Packet Antenna: 1
Step 2
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -60
ToA_ToD: 0xffffff45
Packet Antenna: 1
Step 3
Mode Type: 1
Aborted: No
Packet Quality: 0x00
CS Access Address check is successful
Bit errors: 0
Packet NADM: Unknown NADM (0xff)
Packet RSSI: -54
ToA_ToD: 0xffffff53
Packet Antenna: 1
---
monitor/att.c | 523 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 501 insertions(+), 22 deletions(-)
diff --git a/monitor/att.c b/monitor/att.c
index 03d46634f..278ac5675 100644
--- a/monitor/att.c
+++ b/monitor/att.c
@@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
print_field(" Segment Index: %u", segment_index);
}
-static void print_ras_ranging_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
{
uint16_t ranging_counter_config;
uint8_t selected_tx_power;
uint8_t antenna_paths_mask;
uint8_t mask;
+ uint8_t num_antenna_paths = 0;
+ uint8_t i;
if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
print_text(COLOR_ERROR, " Ranging Header: invalid size");
- return;
+ return 0;
}
/* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
@@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
print_text(COLOR_ERROR, " Selected TX Power: invalid size");
- return;
+ return 0;
}
print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
- return;
+ return 0;
}
print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
@@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (mask)
print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
+
+ /* Count the number of set bits in antenna_paths_mask */
+ for (i = 0; i < 4; i++) {
+ if (antenna_paths_mask & (1 << i))
+ num_antenna_paths++;
+ }
+
+ return num_antenna_paths;
}
static const char *ras_ranging_done_status_str(uint8_t status)
@@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
}
}
-static void print_ras_subevent_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
{
uint16_t start_acl_conn_event;
uint16_t freq_compensation;
@@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
print_text(COLOR_ERROR,
" Start ACL Connection Event: invalid size");
- return;
+ return 0;
}
print_field(" Start ACL Connection Event: %u",
@@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
print_text(COLOR_ERROR,
" Frequency Compensation: invalid size");
- return;
+ return 0;
}
print_field(" Frequency Compensation: %d (0.01 ppm)",
@@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
print_text(COLOR_ERROR, " Status: invalid size");
- return;
+ return 0;
}
ranging_done_status = status_byte1 & 0x0F;
@@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
print_text(COLOR_ERROR, " Abort Reasons: invalid size");
- return;
+ return 0;
}
ranging_abort_reason = status_byte2 & 0x0F;
@@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
print_text(COLOR_ERROR,
" Reference Power Level: invalid size");
- return;
+ return 0;
}
print_field(" Reference Power Level: %d dBm",
@@ -4273,16 +4283,466 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
print_text(COLOR_ERROR,
" Number of Steps Reported: invalid size");
- return;
+ return 0;
}
print_field(" Number of Steps Reported: %u", num_steps_reported);
+
+ return num_steps_reported;
+}
+
+static const char *packet_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "CS Access Address check is successful, and all bits "
+ "match the expected sequence";
+ case 0x01:
+ return "CS Access Address check is successful, but some bits "
+ "do not match the expected sequence";
+ case 0x02:
+ return "CS Access Address check failed";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "Tone quality is high";
+ case 0x01:
+ return "Tone quality is medium";
+ case 0x02:
+ return "Tone quality is low";
+ case 0x03:
+ return "Tone quality indication is not available";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_extension_str(uint8_t quality)
+{
+ switch ((quality >> 4) & 0x03) {
+ case 0x00:
+ return "Not tone extension slot";
+ case 0x01:
+ return "Tone extension slot; tone not expected to be present";
+ case 0x02:
+ return "Tone extension slot; tone expected to be present";
+ default:
+ return "Reserved";
+ }
+}
+
+static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, rssi, antenna;
+ uint16_t freq_offset;
+
+ if (len < 3) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR,
+ " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ if (len == 5) {
+ if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
+ print_text(COLOR_ERROR,
+ " Measured Freq Offset: invalid size");
+ return;
+ }
+
+ print_field(" Measured Freq Offset: %d (0.01 ppm)",
+ (int16_t)freq_offset);
+ }
+}
+
+static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+}
+
+static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t quality;
+
+ if (len < 1) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(quality),
+ quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(quality),
+ (quality >> 4) & 0x03);
+ }
+}
+
+static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t tone_quality;
+
+ /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ /* Parse Mode 1 data first */
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid size");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid size");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid size");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ /* Now parse Mode 2 data */
+ if (frame->size < 1)
+ return;
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ tone_quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(tone_quality),
+ tone_quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(tone_quality),
+ (tone_quality >> 4) & 0x03);
+ }
+}
+
+static void print_ranging_steps(const struct l2cap_frame *frame,
+ uint8_t num_steps, uint8_t num_antenna_paths)
+{
+ uint8_t step_idx;
+
+ for (step_idx = 0; step_idx < num_steps && frame->size > 0;
+ step_idx++) {
+ uint8_t mode_byte;
+ uint8_t mode_type;
+ bool aborted;
+ uint8_t step_data_len;
+
+ if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
+ print_text(COLOR_ERROR,
+ " Step %u: Mode: invalid size",
+ step_idx);
+ return;
+ }
+
+ mode_type = mode_byte & 0x03;
+ aborted = (mode_byte & 0x80) != 0;
+
+ print_field(" Step %u", step_idx);
+ print_field(" Mode Type: %u", mode_type);
+ print_field(" Aborted: %s", aborted ? "Yes" : "No");
+
+ /* If aborted, step data length is 0 */
+ if (aborted)
+ continue;
+
+ /* Determine step data length based on mode type
+ * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
+ * (reflector)
+ * Mode 1: Always 6 bytes
+ * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
+ * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
+ * num_antenna_paths * 4 bytes
+ */
+ switch (mode_type) {
+ case 0:
+ /* Mode 0: Default to 3 bytes (reflector)
+ * Only use 5 bytes if we're the last step AND have
+ * exactly 5 bytes remaining
+ */
+ if (step_idx == num_steps - 1 && frame->size == 5) {
+ /* Initiator - last step with exactly 5 bytes */
+ step_data_len = 5;
+ } else if (frame->size >= 3) {
+ /* Reflector - default case */
+ step_data_len = 3;
+ } else {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 0");
+ return;
+ }
+ break;
+ case 1:
+ /* Mode 1: Always 6 bytes */
+ if (frame->size < 6) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 1");
+ return;
+ }
+ step_data_len = 6;
+ break;
+ case 2:
+ /* Mode 2: 1 byte antenna + num_antenna_paths * 4
+ * bytes per path
+ */
+ step_data_len = 1 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 2 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ case 3:
+ /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
+ * num_antenna_paths * 4 bytes
+ */
+ step_data_len = 7 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 3 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ default:
+ print_text(COLOR_ERROR, " Unknown mode type");
+ return;
+ }
+
+ if (step_data_len > frame->size) {
+ print_text(COLOR_ERROR,
+ " Invalid step data length");
+ return;
+ }
+
+ if (step_data_len > 0) {
+ struct l2cap_frame step_frame;
+
+ l2cap_frame_clone(&step_frame, frame);
+ step_frame.size = step_data_len;
+
+ switch (mode_type) {
+ case 0:
+ print_step_mode_0(&step_frame, step_data_len);
+ break;
+ case 1:
+ print_step_mode_1(&step_frame, step_data_len);
+ break;
+ case 2:
+ print_step_mode_2(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ case 3:
+ print_step_mode_3(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ }
+
+ if (!l2cap_frame_pull((void *)frame, frame,
+ step_data_len))
+ return;
+ }
+ }
}
static void ras_ranging_data_read(const struct l2cap_frame *frame)
{
uint8_t seg_header;
- bool first_segment;
+ bool first_segment = true;
if (!l2cap_frame_get_u8((void *)frame, &seg_header)) {
print_text(COLOR_ERROR, " Segmentation Header: invalid size");
@@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
print_ras_segmentation_header(seg_header);
first_segment = seg_header & 0x01;
-
/* Only try to decode headers if this is the first segment */
- if (first_segment && frame->size >= 6) {
+ if (first_segment && frame->size >= 4) {
+ uint8_t num_steps;
+ uint8_t num_antenna_paths;
+
print_field(" Ranging Data Body:");
- print_ras_ranging_header(frame);
+ num_antenna_paths = print_ras_ranging_header(frame);
/* Try to decode subevent header if enough data remains */
- if (frame->size >= 10) {
+ if (frame->size >= 8) {
print_field(" Subevent #0:");
- print_ras_subevent_header(frame);
+ num_steps = print_ras_subevent_header(frame);
+
+ /* Parse steps if we have num_steps and
+ * num_antenna_paths
+ */
+ if (num_steps > 0 && num_antenna_paths > 0 &&
+ frame->size > 0) {
+ print_ranging_steps((void *)frame, num_steps,
+ num_antenna_paths);
+ }
}
+ } else if (!first_segment && frame->size > 0) {
+ /* For continuation segments, we cannot reliably decode without
+ * full segment reassembly, as steps may be split across
+ * segments.
+ * Just show the raw data.
+ */
+ print_field(" Continuation Segment (raw data - requires "
+ "reassembly for proper decoding):");
+ print_hex_field(" Segment Data", frame->data, frame->size);
}
- if (frame->size > 0) {
- print_hex_field(" Remaining Ranging Data Segment", frame->data,
- frame->size);
- }
+ if (frame->size > 0 && first_segment)
+ print_hex_field(" Remaining Ranging Data Segment",
+ frame->data, frame->size);
done:
- if (frame->size)
+ if (frame->size && first_segment)
print_hex_field(" Remaining Data", frame->data, frame->size);
}
--
2.34.1
^ permalink raw reply related
* RE: Bluetooth: btintel_pcie: fix stale cache in set_dxstate fallback check
From: bluez.test.bot @ 2026-05-07 21:06 UTC (permalink / raw)
To: linux-bluetooth, vladimirkondratyev2
In-Reply-To: <20260507203426.128975-1-vladimirkondratyev2@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091276
---Test result---
Test Summary:
CheckPatch PASS 0.69 seconds
GitLint PASS 0.30 seconds
SubjectPrefix PASS 0.11 seconds
BuildKernel PASS 27.57 seconds
CheckAllWarning PASS 30.23 seconds
CheckSparse PASS 28.95 seconds
BuildKernel32 PASS 27.07 seconds
TestRunnerSetup PASS 582.94 seconds
IncrementalBuild PASS 25.20 seconds
https://github.com/bluez/bluetooth-next/pull/155
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature
From: bluez.test.bot @ 2026-05-07 20:38 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260507174205.209488-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2137 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091208
---Test result---
Test Summary:
CheckPatch PASS 2.66 seconds
GitLint FAIL 0.57 seconds
SubjectPrefix PASS 0.22 seconds
BuildKernel PASS 26.44 seconds
CheckAllWarning PASS 28.96 seconds
CheckSparse PASS 27.68 seconds
BuildKernel32 PASS 25.19 seconds
TestRunnerSetup PASS 560.65 seconds
TestRunner_l2cap-tester PASS 377.96 seconds
TestRunner_iso-tester PASS 593.01 seconds
TestRunner_bnep-tester PASS 18.45 seconds
TestRunner_mgmt-tester PASS 2034.02 seconds
TestRunner_rfcomm-tester PASS 74.65 seconds
TestRunner_sco-tester PASS 141.23 seconds
TestRunner_ioctl-tester PASS 133.55 seconds
TestRunner_mesh-tester PASS 59.86 seconds
TestRunner_smp-tester PASS 17.97 seconds
TestRunner_userchan-tester PASS 19.24 seconds
TestRunner_6lowpan-tester PASS 51.22 seconds
IncrementalBuild PASS 42.05 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[v4,1/2] Bluetooth: HCI: Add initial support for Short Connection Interval feature"
https://github.com/bluez/bluetooth-next/pull/154
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: (subset) [PATCH v3 00/10] Fix up WCN6855 RFA power supply name
From: Bjorn Andersson @ 2026-05-07 20:34 UTC (permalink / raw)
To: Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Balakrishna Godavarthi, Rocky Liao,
Bartosz Golaszewski, Konrad Dybcio
Cc: Luiz Augusto von Dentz, linux-arm-msm, linux-bluetooth,
devicetree, linux-kernel, Konrad Dybcio, Krzysztof Kozlowski,
Abel Vesa, Bartosz Golaszewski, Dmitry Baryshkov
In-Reply-To: <20260225-topic-wcn6855_pmu_dtbdings-v3-0-576ec5c4e631@oss.qualcomm.com>
On Wed, 25 Feb 2026 13:23:20 +0100, Konrad Dybcio wrote:
> Commit 5f4f954bba12 ("dt-bindings: bluetooth: bring the HW description
> closer to reality for wcn6855") renamed the supply representing the
> VDD17_PMU_RFA leg to mention "1p8" instead.
>
> While the supply's voltage is normally 1.8 V, the bindings should
> reflect the actual naming of the pin. Moreover, almost all DTs define
> the output as 1p7, so that ends up looking a little odd..
>
> [...]
Applied, thanks!
[02/10] arm64: dts: qcom: qcs615-ride: Fix BT RFA supply name
commit: 244e064bc8ce848d40fe13451b6096a66b2bbdb2
[03/10] arm64: dts: qcom: sc8280xp-crd: Fix BT RFA supply name
commit: d28f68b052780b945c35996d02adf2426ed0bff7
[04/10] arm64: dts: qcom: sc8280xp-gaokun3: Fix BT RFA supply name
commit: fa99d3af7edb8acd735e861446477afd64007af7
[05/10] arm64: dts: qcom: sc8280xp-x13s: Fix BT RFA supply name
commit: de1a7dc3ccda556bef52185ae1d65ebb900b2925
[06/10] arm64: dts: qcom: sc8280xp-blackrock: Fix BT RFA supply name
commit: a25cd984f4078cb772179787cf78790bbcc2c543
[07/10] arm64: dts: qcom: sm8450-hdk: Fix BT RFA supply name
commit: 557a49f764306ccf8155ca19970be78d90f8d3de
[08/10] arm64: dts: qcom: x1-omnibook-x14: Fix BT RFA supply name
commit: e5a38ea7633853433295106650d008c1428d4d0e
[09/10] arm64: dts: qcom: x1-zenbook-a14: Fix BT RFA supply name
commit: 8be58b9b8a10ac276d4058c66ebd6b2b9e5aa683
[10/10] arm64: dts: qcom: lemans-ride-common: Fix up WCN power grid
commit: d859095bcafc4c5e26c551350d2327aeb2e08e59
Best regards,
--
Bjorn Andersson <andersson@kernel.org>
^ permalink raw reply
* [PATCH] Bluetooth: btintel_pcie: fix stale cache in set_dxstate fallback check
From: Vladimir V. Kondratyev @ 2026-05-07 20:34 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Chandrashekar Devegowda, Kiran K, Paul Menzel, Arnd Bergmann,
linux-bluetooth, linux-kernel, Vladimir V. Kondratyev
btintel_pcie_set_dxstate() falls back to checking the controller state via
btintel_pcie_in_d3/d0() when the alive interrupt is missed. However, these
helpers read boot_stage_cache, which is only updated by the interrupt
handler. As such, if the interrupt was missed, the cache is stale and the
fallback check always fails, exhausting all retries and returning -EBUSY,
causing suspend to abort.
The fix involves re-reading the hardware register before the fallback state
check, consistent with btintel_pcie_resume().
Fixes: e57362f4911b ("Bluetooth: btintel_pcie: Add support for _suspend() / _resume()")
Signed-off-by: Vladimir V. Kondratyev <vladimirkondratyev2@gmail.com>
---
drivers/bluetooth/btintel_pcie.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index fda474406003..7fca8eea6e01 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2778,9 +2778,13 @@ static int btintel_pcie_set_dxstate(struct btintel_pcie_data *data, u32 dxstate)
BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0);
/* A hardware bug may cause the alive interrupt to be missed.
- * Check if the controller reached the expected state and retry
- * the operation only if it hasn't.
+ * Refresh boot_stage_cache from hardware since it is only
+ * updated by the interrupt handler, then check if the
+ * controller reached the expected state and retry the
+ * operation only if it hasn't.
*/
+ data->boot_stage_cache = btintel_pcie_rd_reg32(data,
+ BTINTEL_PCIE_CSR_BOOT_STAGE_REG);
if (dxstate == BTINTEL_PCIE_STATE_D0) {
if (btintel_pcie_in_d0(data))
return 0;
--
2.54.0
^ permalink raw reply related
* [Bug 221481] New: btintel_pcie: suspend fails with -EBUSY on Intel Lunar Lake (s2idle)
From: bugzilla-daemon @ 2026-05-07 19:28 UTC (permalink / raw)
To: linux-bluetooth
https://bugzilla.kernel.org/show_bug.cgi?id=221481
Bug ID: 221481
Summary: btintel_pcie: suspend fails with -EBUSY on Intel Lunar
Lake (s2idle)
Product: Drivers
Version: 2.5
Hardware: Intel
OS: Linux
Status: NEW
Severity: blocking
Priority: P3
Component: Bluetooth
Assignee: linux-bluetooth@vger.kernel.org
Reporter: vladko@duck.com
Regression: No
Summary:
btintel_pcie returns -16 (EBUSY) during suspend, causing the entire suspend
operation to abort on Intel Lunar Lake hardware. The system immediately resumes
after every suspend attempt.
Hardware:
- CPU/Platform: Intel Lunar Lake
- Bluetooth device: btintel_pcie at PCI 0000:00:14.7
- iGPU: Intel Arc 140V (xe driver)
Software
- Kernel: 6.19.13-arch1-1
- Distribution: EndeavourOS (Arch-based)
- Desktop: KDE Plasma (Wayland)
- Sleep state: s2idle only (mem_sleep shows [s2idle], no S3/deep)
Reproduction
1. Boot system with btintel_pcie loaded
2. Run: systemctl suspend
3. System immediately wakes up; suspend never enters sleep state
Kernel log (relevant excerpt)
kernel: PM: suspend entry (s2idle)
kernel: btintel_pcie 0000:00:14.7: PM: pci_pm_suspend(): btintel_pcie_suspend
[btintel_pcie] returns -16
kernel: btintel_pcie 0000:00:14.7: PM: dpm_run_callback(): pci_pm_suspend
returns -16
kernel: btintel_pcie 0000:00:14.7: PM: failed to suspend async: error -16
kernel: PM: Some devices failed to suspend, or early wake event detected
kernel: PM: suspend exit
systemd-sleep: Failed to put system to sleep. System resumed again: Device or
resource busy
Workaround
Manually unloading the module before suspend allows sleep to succeed:
modprobe -r btintel_pcie && systemctl suspend
Expected behavior
btintel_pcie should successfully suspend alongside the rest of the system
during
s2idle, or yield gracefully so the suspend proceeds without it.
Notes
/sys/power/mem_sleep reports [s2idle] only (no deep/S3), consistent with
Lunar Lake's lack of S3 support. The issue is reproducible 100% of the time
with the module loaded.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* RE: [BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
From: bluez.test.bot @ 2026-05-07 19:11 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260507180736.2990540-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 48238 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091217
---Test result---
Test Summary:
CheckPatch PASS 0.75 seconds
GitLint FAIL 0.29 seconds
BuildEll PASS 20.32 seconds
BluezMake FAIL 634.48 seconds
MakeCheck FAIL 7.84 seconds
MakeDistcheck PASS 247.55 seconds
CheckValgrind FAIL 202.16 seconds
CheckSmatch FAIL 324.56 seconds
bluezmakeextell FAIL 171.75 seconds
IncrementalBuild FAIL 632.89 seconds
ScanBuild FAIL 423.81 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (255>80): "[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c"
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%'
tools/sco-tester.c: note: in included file:
./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures
./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures
tools/bneptest.c:634:39: warning: unknown escape sequence: '\%'
tools/seq2bseq.c:57:26: warning: Variable length array is used.
tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/btpclient/gatt.c: note: in included file:
./src/shared/btp.h:328:41: warning: array of flexible structures
./src/shared/btp.h:333:55: warning: array of flexible structures
./src/shared/btp.h:356:47: warning: array of flexible structures
./src/shared/btp.h:385:42: warning: array of flexible structures
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
unit/avctp.c:505:34: warning: Variable length array is used.
unit/avctp.c:556:34: warning: Variable length array is used.
unit/test-avrcp.c:373:26: warning: Variable length array is used.
unit/test-avrcp.c:398:26: warning: Variable length array is used.
unit/test-avrcp.c:414:24: warning: Variable length array is used.
unit/avrcp-lib.c:1085:34: warning: Variable length array is used.
unit/avrcp-lib.c:1583:34: warning: Variable length array is used.
unit/avrcp-lib.c:1612:34: warning: Variable length array is used.
unit/avrcp-lib.c:1638:34: warning: Variable length array is used.
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/main.c: note: in included file (through src/device.h):
./src/shared/queue.h:19:20: error: redefinition of struct queue_entry
mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used.
client/display.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/packet.c:2000:26: warning: Variable length array is used.
monitor/packet.c: note: in included file:
monitor/bt.h:3909:52: warning: array of flexible structures
monitor/bt.h:3897:40: warning: array of flexible structures
monitor/msft.c: note: in included file:
monitor/msft.h:88:44: warning: array of flexible structures
tools/rctest.c:631:33: warning: non-ANSI function declaration of function 'automated_send_recv'
tools/hex2hcd.c:136:26: warning: Variable length array is used.
tools/meshctl.c:324:33: warning: non-ANSI function declaration of function 'forget_mesh_devices'
tools/mesh-gatt/node.c:456:39: warning: non-ANSI function declaration of function 'node_get_local_node'
tools/mesh-gatt/net.c:1239:30: warning: non-ANSI function declaration of function 'get_next_seq'
tools/mesh-gatt/net.c:2193:29: warning: non-ANSI function declaration of function 'net_get_default_ttl'
tools/mesh-gatt/net.c:2207:26: warning: non-ANSI function declaration of function 'net_get_seq_num'
tools/mesh-gatt/prov.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-gatt/onoff-model.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
ell/log.c:431:65: warning: non-ANSI function declaration of function 'register_debug_section'
ell/log.c:439:68: warning: non-ANSI function declaration of function 'free_debug_sections'
ell/random.c:60:42: warning: non-ANSI function declaration of function 'l_getrandom_is_supported'
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results c
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 6)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read
i = execvp(cmdargv[0], cmdargv);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull'
i = execvp(cmdargv[0], cmdargv);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined
req.channel = raddr.rc_channel;
^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value
sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int'
uint32_t *value_int = malloc(sizeof(int));
~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value
free(allocArray[i]);
^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name'
return add_service(0, &si);
^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc'
return -1;
^~~~~~~~~
4 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read
len = write(sk, buf, invalid ? 2 : 3);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 4 + media_transport_size);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read
len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull'
tcp_port = atoi(optarg);
^~~~~~~~~~~~
tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull'
if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3))
^~~~~~~~~~~~~~
2 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
4 warnings generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read
argv += optind;
^ ~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read
argv -= optind;
^ ~~~~~~
1 warning generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read
ptr = fgets(result, sizeof(result), fp);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value
chr_write(chr, value, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_RDONLY | O_NOCTTY, 0);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read
bit = 0;
^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(cp->data, ad_data, ad_len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value
g_free(text[i]);
^~~~~~~~~~~~~~~
1 warning generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed
if (!cb->resume_cb)
^~~~~~~~~~~~~
profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream')
stream->starting = TRUE;
~~~~~~ ^
profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
if (!stream->suspending && stream->suspend_timer) {
^~~~~~~~~~~~~~~~~~
profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
stream->suspending = TRUE;
~~~~~~ ^
4 warnings generated.
profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read
operands += sizeof(*pdu);
^ ~~~~~~~~~~~~
1 warning generated.
attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write'
return prepare_write(long_write);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(to, from, count);
^~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
mesh/main.c:162:3: warning: Value stored to 'optarg' is never read
optarg += strlen("auto");
^ ~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/hci.c:97:4: warning: Value stored to 'ptr' is never read
ptr += sprintf(ptr, "%s", m->str);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
client/player.c:2363:8: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
if (!strcmp(ep->path, pattern))
^~~~~~~~~~~~~~~~~~~~~~~~~
client/player.c:3640:16: warning: Null pointer passed to 1st parameter expecting 'nonnull'
codec->name = strdup(name);
^~~~~~~~~~~~
2 warnings generated.
gdbus/watch.c:226:3: warning: Attempt to free released memory
g_free(l->data);
^~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/sdp.c:509:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:539:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1885:26: warning: Potential leak of memory pointed to by 'ap'
for (; pdlist; pdlist = pdlist->next) {
^~~~~~
lib/bluetooth/sdp.c:1899:6: warning: Potential leak of memory pointed to by 'pds'
ap = sdp_list_append(ap, pds);
~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1944:10: warning: Potential leak of memory pointed to by 'u'
*seqp = sdp_list_append(*seqp, u);
~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:2049:4: warning: Potential leak of memory pointed to by 'lang'
sdp_list_free(*langSeq, free);
^~~~~~~~~~~~~
lib/bluetooth/sdp.c:2138:9: warning: Potential leak of memory pointed to by 'profDesc'
return 0;
^
lib/bluetooth/sdp.c:3270:8: warning: Potential leak of memory pointed to by 'pSvcRec'
pSeq = sdp_list_append(pSeq, pSvcRec);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:3271:9: warning: Potential leak of memory pointed to by 'pSeq'
pdata += sizeof(uint32_t);
~~~~~~^~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:4607:13: warning: Potential leak of memory pointed to by 'rec_list'
} while (scanned < attr_list_len && pdata_len > 0);
^~~~~~~
lib/bluetooth/sdp.c:4903:40: warning: Potential leak of memory pointed to by 'tseq'
for (d = sdpdata->val.dataseq; d; d = d->next) {
^
lib/bluetooth/sdp.c:4939:8: warning: Potential leak of memory pointed to by 'subseq'
tseq = sdp_list_append(tseq, subseq);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
monitor/l2cap.c:1676:4: warning: Value stored to 'data' is never read
data += len;
^ ~~~
monitor/l2cap.c:1677:4: warning: Value stored to 'size' is never read
size -= len;
^ ~~~
2 warnings generated.
monitor/hwdb.c:59:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:64:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
monitor/hwdb.c:106:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:111:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
4 warnings generated.
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4793:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4793 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
https://github.com/bluez/bluez/pull/2108
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ,v1] monitor: Add parsing of CS step mode data in RAS Notifications
From: bluez.test.bot @ 2026-05-07 19:09 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260507171342.2971553-1-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 46779 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091197
---Test result---
Test Summary:
CheckPatch PASS 0.71 seconds
GitLint PASS 0.27 seconds
BuildEll PASS 18.32 seconds
BluezMake FAIL 622.01 seconds
MakeCheck FAIL 7.25 seconds
MakeDistcheck PASS 223.69 seconds
CheckValgrind FAIL 189.34 seconds
CheckSmatch FAIL 290.87 seconds
bluezmakeextell FAIL 159.72 seconds
IncrementalBuild FAIL 648.39 seconds
ScanBuild FAIL 394.98 seconds
Details
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%'
tools/sco-tester.c: note: in included file:
./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures
./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures
tools/bneptest.c:634:39: warning: unknown escape sequence: '\%'
tools/seq2bseq.c:57:26: warning: Variable length array is used.
tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
client/btpclient/gatt.c: note: in included file:
./src/shared/btp.h:328:41: warning: array of flexible structures
./src/shared/btp.h:333:55: warning: array of flexible structures
./src/shared/btp.h:356:47: warning: array of flexible structures
./src/shared/btp.h:385:42: warning: array of flexible structures
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
unit/avctp.c:505:34: warning: Variable length array is used.
unit/avctp.c:556:34: warning: Variable length array is used.
unit/test-avrcp.c:373:26: warning: Variable length array is used.
unit/test-avrcp.c:398:26: warning: Variable length array is used.
unit/test-avrcp.c:414:24: warning: Variable length array is used.
unit/avrcp-lib.c:1085:34: warning: Variable length array is used.
unit/avrcp-lib.c:1583:34: warning: Variable length array is used.
unit/avrcp-lib.c:1612:34: warning: Variable length array is used.
unit/avrcp-lib.c:1638:34: warning: Variable length array is used.
src/advertising.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/agent.c: note: in included file:
src/shared/queue.h:19:20: error: redefinition of struct queue_entry
src/adv_monitor.c: note: in included file:
./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability
src/main.c: note: in included file (through src/device.h):
./src/shared/queue.h:19:20: error: redefinition of struct queue_entry
mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used.
client/display.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
src/shared/crypto.c:271:21: warning: Variable length array is used.
src/shared/crypto.c:272:23: warning: Variable length array is used.
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used.
src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used.
src/shared/gatt-server.c:279:25: warning: Variable length array is used.
src/shared/gatt-server.c:622:25: warning: Variable length array is used.
src/shared/gatt-server.c:720:25: warning: Variable length array is used.
src/shared/bap.c:312:25: warning: array of flexible structures
src/shared/bap.c: note: in included file:
./src/shared/ascs.h:88:25: warning: array of flexible structures
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/packet.c:2000:26: warning: Variable length array is used.
monitor/packet.c: note: in included file:
monitor/bt.h:3909:52: warning: array of flexible structures
monitor/bt.h:3897:40: warning: array of flexible structures
monitor/msft.c: note: in included file:
monitor/msft.h:88:44: warning: array of flexible structures
tools/rctest.c:631:33: warning: non-ANSI function declaration of function 'automated_send_recv'
tools/hex2hcd.c:136:26: warning: Variable length array is used.
tools/meshctl.c:324:33: warning: non-ANSI function declaration of function 'forget_mesh_devices'
tools/mesh-gatt/node.c:456:39: warning: non-ANSI function declaration of function 'node_get_local_node'
tools/mesh-gatt/net.c:1239:30: warning: non-ANSI function declaration of function 'get_next_seq'
tools/mesh-gatt/net.c:2193:29: warning: non-ANSI function declaration of function 'net_get_default_ttl'
tools/mesh-gatt/net.c:2207:26: warning: non-ANSI function declaration of function 'net_get_seq_num'
tools/mesh-gatt/prov.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
tools/mesh-gatt/onoff-model.c: note: in included file (through /usr/include/readline/readline.h):
/usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function'
/usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction'
/usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction'
/usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction'
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v1] monitor: Add parsing of CS step mode data in RAS Notifications
tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
| ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
766 | int main(int argc, char *argv[])
| ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
989 | int main(int argc, char *argv[])
| ^~~~
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 10)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 4)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n'
if ((n = read_hci_event(fd, resp, 6)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read
i = execvp(cmdargv[0], cmdargv);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull'
i = execvp(cmdargv[0], cmdargv);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined
req.channel = raddr.rc_channel;
^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd'
if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value
sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int'
uint32_t *value_int = malloc(sizeof(int));
~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value
free(allocArray[i]);
^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name'
return add_service(0, &si);
^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc'
return -1;
^~~~~~~~~
4 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read
len = write(sk, buf,
^ ~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 4);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read
len = write(sk, buf, invalid ? 2 : 3);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 4 + media_transport_size);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 3);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read
len = write(sk, buf, 2);
^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read
len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull'
tcp_port = atoi(optarg);
^~~~~~~~~~~~
tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull'
if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3))
^~~~~~~~~~~~~~
2 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read
fd = -1;
^ ~~
4 warnings generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read
argv += optind;
^ ~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read
argv -= optind;
^ ~~~~~~
1 warning generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read
ptr = fgets(result, sizeof(result), fp);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value
chr_write(chr, value, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull'
data->fd = open(name, O_RDONLY | O_NOCTTY, 0);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read
bit = 0;
^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(cp->data, ad_data, ad_len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value
g_free(text[i]);
^~~~~~~~~~~~~~~
1 warning generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed
session->prio_queue = g_slist_remove(session->prio_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed
session->req_queue = g_slist_remove(session->req_queue, req);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed
if (!cb->resume_cb)
^~~~~~~~~~~~~
profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream')
stream->starting = TRUE;
~~~~~~ ^
profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
if (!stream->suspending && stream->suspend_timer) {
^~~~~~~~~~~~~~~~~~
profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream')
stream->suspending = TRUE;
~~~~~~ ^
4 warnings generated.
profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read
operands += sizeof(*pdu);
^ ~~~~~~~~~~~~
1 warning generated.
attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write'
return prepare_write(long_write);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t'
pElem = malloc(sizeof(uint16_t));
^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t'
pElem = malloc(sizeof(uint32_t));
^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer
(*ctxt)->cb = cb;
~~~~~~~~~~~~^~~~
1 warning generated.
src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined
buf[1] = data[i + 1];
^ ~~~~~~~~~~~
3 warnings generated.
src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read
uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING,
^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/gatt-client.c:1569:2: warning: Use of memory after it is freed
notify_client_unref(client);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
memcpy(to, from, count);
^~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
mesh/main.c:162:3: warning: Value stored to 'optarg' is never read
optarg += strlen("auto");
^ ~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/hci.c:97:4: warning: Value stored to 'ptr' is never read
ptr += sprintf(ptr, "%s", m->str);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
client/player.c:2363:8: warning: Null pointer passed to 2nd parameter expecting 'nonnull'
if (!strcmp(ep->path, pattern))
^~~~~~~~~~~~~~~~~~~~~~~~~
client/player.c:3640:16: warning: Null pointer passed to 1st parameter expecting 'nonnull'
codec->name = strdup(name);
^~~~~~~~~~~~
2 warnings generated.
gdbus/watch.c:226:3: warning: Attempt to free released memory
g_free(l->data);
^~~~~~~~~~~~~~~
1 warning generated.
lib/bluetooth/sdp.c:509:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:539:17: warning: Dereference of undefined pointer value
uint8_t dtd = *(uint8_t *) dtds[i];
^~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1885:26: warning: Potential leak of memory pointed to by 'ap'
for (; pdlist; pdlist = pdlist->next) {
^~~~~~
lib/bluetooth/sdp.c:1899:6: warning: Potential leak of memory pointed to by 'pds'
ap = sdp_list_append(ap, pds);
~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:1944:10: warning: Potential leak of memory pointed to by 'u'
*seqp = sdp_list_append(*seqp, u);
~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:2049:4: warning: Potential leak of memory pointed to by 'lang'
sdp_list_free(*langSeq, free);
^~~~~~~~~~~~~
lib/bluetooth/sdp.c:2138:9: warning: Potential leak of memory pointed to by 'profDesc'
return 0;
^
lib/bluetooth/sdp.c:3270:8: warning: Potential leak of memory pointed to by 'pSvcRec'
pSeq = sdp_list_append(pSeq, pSvcRec);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:3271:9: warning: Potential leak of memory pointed to by 'pSeq'
pdata += sizeof(uint32_t);
~~~~~~^~~~~~~~~~~~~~~~~~~
lib/bluetooth/sdp.c:4607:13: warning: Potential leak of memory pointed to by 'rec_list'
} while (scanned < attr_list_len && pdata_len > 0);
^~~~~~~
lib/bluetooth/sdp.c:4903:40: warning: Potential leak of memory pointed to by 'tseq'
for (d = sdpdata->val.dataseq; d; d = d->next) {
^
lib/bluetooth/sdp.c:4939:8: warning: Potential leak of memory pointed to by 'subseq'
tseq = sdp_list_append(tseq, subseq);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed
gatt_db_unregister(op->client->db, op->db_id);
^~~~~~~~~~
src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed
discovery_op_complete(op, false, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed
discovery_op_complete(op, success, att_ecode);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed
discover_all(op);
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed
notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed
if (read_db_hash(op)) {
^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed
discovery_op_ref(op),
^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed
complete_write_long_op(req, success, 0, false);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed
request_unref(req);
^~~~~~~~~~~~~~~~~~
13 warnings generated.
src/shared/rap.c:1189:7: warning: Branch condition evaluates to a garbage value
if (!ok) {
^~~
1 warning generated.
src/shared/bap.c:1529:8: warning: Use of memory after it is freed
bap = bt_bap_ref_safe(bap);
^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2340:20: warning: Use of memory after it is freed
return queue_find(stream->bap->streams, NULL, stream);
^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
monitor/l2cap.c:1676:4: warning: Value stored to 'data' is never read
data += len;
^ ~~~
monitor/l2cap.c:1677:4: warning: Value stored to 'size' is never read
size -= len;
^ ~~~
2 warnings generated.
monitor/hwdb.c:59:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:64:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
monitor/hwdb.c:106:2: warning: Value stored to 'hwdb' is never read
hwdb = udev_hwdb_unref(hwdb);
^ ~~~~~~~~~~~~~~~~~~~~~
monitor/hwdb.c:111:2: warning: Value stored to 'udev' is never read
udev = udev_unref(udev);
^ ~~~~~~~~~~~~~~~~
4 warnings generated.
monitor/att.c: In function ‘ras_ranging_data_read’:
monitor/att.c:4784:18: error: ‘first_segment’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
4784 | if (frame->size && first_segment)
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/att.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
https://github.com/bluez/bluez/pull/2107
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Fixes/improvements for the PCI M.2 power sequencing driver
From: bluez.test.bot @ 2026-05-07 18:51 UTC (permalink / raw)
To: linux-bluetooth, manivannan.sadhasivam
In-Reply-To: <20260507-pwrseq-m2-bt-v2-1-1740bd478539@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 4895 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091159
---Test result---
Test Summary:
CheckPatch PASS 5.83 seconds
GitLint FAIL 2.49 seconds
SubjectPrefix FAIL 0.89 seconds
BuildKernel PASS 27.15 seconds
CheckAllWarning PASS 29.30 seconds
CheckSparse PASS 28.12 seconds
BuildKernel32 PASS 25.66 seconds
TestRunnerSetup PASS 566.63 seconds
TestRunner_l2cap-tester PASS 378.06 seconds
TestRunner_iso-tester PASS 594.73 seconds
TestRunner_bnep-tester PASS 18.80 seconds
TestRunner_mgmt-tester PASS 2022.73 seconds
TestRunner_rfcomm-tester PASS 63.46 seconds
TestRunner_sco-tester PASS 141.37 seconds
TestRunner_ioctl-tester PASS 133.16 seconds
TestRunner_mesh-tester PASS 59.66 seconds
TestRunner_smp-tester PASS 17.73 seconds
TestRunner_userchan-tester PASS 19.19 seconds
TestRunner_6lowpan-tester PASS 51.12 seconds
IncrementalBuild PASS 37.89 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2,2/9] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (83>80): "[v2,2/9] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices"
[v2,4/9] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (87>80): "[v2,4/9] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe"
[v2,5/9] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (86>80): "[v2,5/9] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table"
[v2,8/9] power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[v2,8/9] power: sequencing: Add an API to return the pwrseq device's 'dev' pointer"
[v2,9/9] Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (97>80): "[v2,9/9] Bluetooth: hci_qca: Set 'bt_en_available' based on W_DISABLE2# presence in M.2 connector"
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
https://github.com/bluez/bluetooth-next/pull/153
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1090721
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 27dcd3: monitor: Add parsing of CS step mode data in RAS N...
From: prathibhamadugonde @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091217
Home: https://github.com/bluez/bluez
Commit: 27dcd34c10709dfa5aef33377d882a08538f811d
https://github.com/bluez/bluez/commit/27dcd34c10709dfa5aef33377d882a08538f811d
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -48 Packet Antenna: 1 Step 2 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -60 ToA_ToD: 0xffffff45 Packet Antenna: 1 Step 3 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -54 ToA_ToD: 0xffffff53 Packet Antenna: 1
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 27e1da: monitor: Add parsing of CS step mode data in RAS N...
From: prathibhamadugonde @ 2026-05-07 18:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1091197
Home: https://github.com/bluez/bluez
Commit: 27e1daee95cfa9081887153b978ec5a512c45945
https://github.com/bluez/bluez/commit/27e1daee95cfa9081887153b978ec5a512c45945
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M monitor/att.c
Log Message:
-----------
monitor: Add parsing of CS step mode data in RAS Notifications
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] d45fd4: bap: Fix typo in QoS D-Bus dictionary entry names
From: qarnet @ 2026-05-07 18:25 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: d45fd43a1cc3ba791858f11c144112c518a9ad84
https://github.com/bluez/bluez/commit/d45fd43a1cc3ba791858f11c144112c518a9ad84
Author: Thomas Kirschner <thomaskirschner85@yahoo.de>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
M profiles/audio/bap.c
Log Message:
-----------
bap: Fix typo in QoS D-Bus dictionary entry names
MinimumDelay and PreferredMinimumDelay had wrong spelling, causing
them to be exposed incorrectly over D-Bus. Any client relying on
the correct spelling would fail to find these entries, breaking
LE Audio QoS negotiation.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH BlueZ v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check i...
From: Luiz Augusto von Dentz @ 2026-05-07 18:17 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, quic_mohamull, quic_hbandi, quic_anubhavg
In-Reply-To: <20260507180736.2990540-1-prathm@qti.qualcomm.com>
Hi Prathibha,
On Thu, May 7, 2026 at 2:07 PM Prathibha Madugonde
<prathibha.madugonde@oss.qualcomm.com> wrote:
Not sure what went wrong, but the commit subject is way too big. If
you are trying to add an example of decoded trace produced by these
changes add it in the commit description _after_ the first/subject
line e.g.:
monitor: Add decoding of CS step mode data
<example>
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> ---
> monitor/att.c | 521 ++++++++++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 500 insertions(+), 21 deletions(-)
>
> diff --git a/monitor/att.c b/monitor/att.c
> index 03d46634f..c8915ab04 100644
> --- a/monitor/att.c
> +++ b/monitor/att.c
> @@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
> print_field(" Segment Index: %u", segment_index);
> }
>
> -static void print_ras_ranging_header(const struct l2cap_frame *frame)
> +static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
> {
> uint16_t ranging_counter_config;
> uint8_t selected_tx_power;
> uint8_t antenna_paths_mask;
> uint8_t mask;
> + uint8_t num_antenna_paths = 0;
> + uint8_t i;
>
> if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
> print_text(COLOR_ERROR, " Ranging Header: invalid size");
> - return;
> + return 0;
> }
>
> /* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
> @@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
> print_text(COLOR_ERROR, " Selected TX Power: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
>
> if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
> print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
> @@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
>
> if (mask)
> print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
> +
> + /* Count the number of set bits in antenna_paths_mask */
> + for (i = 0; i < 4; i++) {
> + if (antenna_paths_mask & (1 << i))
> + num_antenna_paths++;
> + }
> +
> + return num_antenna_paths;
> }
>
> static const char *ras_ranging_done_status_str(uint8_t status)
> @@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
> }
> }
>
> -static void print_ras_subevent_header(const struct l2cap_frame *frame)
> +static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
> {
> uint16_t start_acl_conn_event;
> uint16_t freq_compensation;
> @@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
> print_text(COLOR_ERROR,
> " Start ACL Connection Event: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Start ACL Connection Event: %u",
> @@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
> print_text(COLOR_ERROR,
> " Frequency Compensation: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Frequency Compensation: %d (0.01 ppm)",
> @@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
> print_text(COLOR_ERROR, " Status: invalid size");
> - return;
> + return 0;
> }
>
> ranging_done_status = status_byte1 & 0x0F;
> @@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
>
> if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
> print_text(COLOR_ERROR, " Abort Reasons: invalid size");
> - return;
> + return 0;
> }
>
> ranging_abort_reason = status_byte2 & 0x0F;
> @@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
> print_text(COLOR_ERROR,
> " Reference Power Level: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Reference Power Level: %d dBm",
> @@ -4273,10 +4283,460 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
> if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
> print_text(COLOR_ERROR,
> " Number of Steps Reported: invalid size");
> - return;
> + return 0;
> }
>
> print_field(" Number of Steps Reported: %u", num_steps_reported);
> +
> + return num_steps_reported;
> +}
> +
> +static const char *packet_quality_str(uint8_t quality)
> +{
> + switch (quality & 0x03) {
> + case 0x00:
> + return "CS Access Address check is successful, and all bits "
> + "match the expected sequence";
> + case 0x01:
> + return "CS Access Address check is successful, but some bits "
> + "do not match the expected sequence";
> + case 0x02:
> + return "CS Access Address check failed";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static const char *tone_quality_str(uint8_t quality)
> +{
> + switch (quality & 0x03) {
> + case 0x00:
> + return "Tone quality is high";
> + case 0x01:
> + return "Tone quality is medium";
> + case 0x02:
> + return "Tone quality is low";
> + case 0x03:
> + return "Tone quality indication is not available";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static const char *tone_extension_str(uint8_t quality)
> +{
> + switch ((quality >> 4) & 0x03) {
> + case 0x00:
> + return "Not tone extension slot";
> + case 0x01:
> + return "Tone extension slot; tone not expected to be present";
> + case 0x02:
> + return "Tone extension slot; tone expected to be present";
> + default:
> + return "Reserved";
> + }
> +}
> +
> +static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
> +{
> + uint8_t quality, rssi, antenna;
> + uint16_t freq_offset;
> +
> + if (len < 3) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR,
> + " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR,
> + " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +
> + if (len == 5) {
> + if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
> + print_text(COLOR_ERROR,
> + " Measured Freq Offset: invalid size");
> + return;
> + }
> +
> + print_field(" Measured Freq Offset: %d (0.01 ppm)",
> + (int16_t)freq_offset);
> + }
> +}
> +
> +static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
> +{
> + uint8_t quality, nadm, rssi, antenna;
> + uint16_t toa_tod;
> +
> + if (len < 6) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR, " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
> + print_text(COLOR_ERROR, " Packet NADM: invalid");
> + return;
> + }
> +
> + if (nadm == 0xFF)
> + print_field(" Packet NADM: Unknown NADM (0xff)");
> + else
> + print_field(" Packet NADM: %u", nadm);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
> + print_text(COLOR_ERROR, " ToA_ToD: invalid");
> + return;
> + }
> +
> + print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR, " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +}
> +
> +static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
> + uint8_t num_antenna_paths)
> +{
> + uint8_t ant_perm_idx;
> + uint8_t i;
> + uint32_t pct;
> + uint16_t i_sample, q_sample;
> + uint8_t quality;
> +
> + if (len < 1) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
> + print_text(COLOR_ERROR, " Antenna Permutation Index: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Antenna Permutation Index: %u", ant_perm_idx);
> +
> + /* Use the antenna paths count from ranging header */
> + for (i = 0; i < (num_antenna_paths + 1); i++) {
> + if (frame->size < 4) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for path %u",
> + i);
> + return;
> + }
> +
> + if (!l2cap_frame_get_le24((void *)frame, &pct)) {
> + print_text(COLOR_ERROR, " PCT: invalid");
> + return;
> + }
> +
> + /* Extract 12-bit I and Q samples from 24-bit PCT */
> + i_sample = pct & 0x0FFF;
> + q_sample = (pct >> 12) & 0x0FFF;
> +
> + print_field(" Path %u", i);
> + print_field(" PCT: 0x%06x", pct);
> + print_field(" I: 0x%03x", i_sample);
> + print_field(" Q: 0x%03x", q_sample);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR,
> + " Tone quality indicator: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Tone quality indicator: 0x%02x",
> + quality);
> + print_field(" %s (0x%02x)",
> + tone_quality_str(quality),
> + quality & 0x03);
> + print_field(" %s (0x%02x)",
> + tone_extension_str(quality),
> + (quality >> 4) & 0x03);
> + }
> +}
> +
> +static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
> + uint8_t num_antenna_paths)
> +{
> + uint8_t quality, nadm, rssi, antenna;
> + uint16_t toa_tod;
> + uint8_t ant_perm_idx;
> + uint8_t i;
> + uint32_t pct;
> + uint16_t i_sample, q_sample;
> + uint8_t tone_quality;
> +
> + /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
> + if (len < 6) {
> + print_hex_field(" Raw step data", frame->data, len);
> + return;
> + }
> +
> + /* Parse Mode 1 data first */
> + if (!l2cap_frame_get_u8((void *)frame, &quality)) {
> + print_text(COLOR_ERROR, " Packet Quality: invalid");
> + return;
> + }
> +
> + print_field(" Packet Quality: 0x%02x", quality);
> + print_field(" %s", packet_quality_str(quality));
> + print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
> + print_text(COLOR_ERROR, " Packet NADM: invalid size");
> + return;
> + }
> +
> + if (nadm == 0xFF)
> + print_field(" Packet NADM: Unknown NADM (0xff)");
> + else
> + print_field(" Packet NADM: %u", nadm);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
> + print_text(COLOR_ERROR, " Packet RSSI: invalid size");
> + return;
> + }
> +
> + print_field(" Packet RSSI: %d", (int8_t)rssi);
> +
> + if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
> + print_text(COLOR_ERROR, " ToA_ToD: invalid size");
> + return;
> + }
> +
> + print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
> + print_text(COLOR_ERROR, " Packet Antenna: invalid");
> + return;
> + }
> +
> + print_field(" Packet Antenna: %u", antenna);
> +
> + /* Now parse Mode 2 data */
> + if (frame->size < 1)
> + return;
> +
> + if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
> + print_text(COLOR_ERROR, " Antenna Permutation Index: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Antenna Permutation Index: %u", ant_perm_idx);
> +
> + /* Use the antenna paths count from ranging header */
> + for (i = 0; i < (num_antenna_paths + 1); i++) {
> + if (frame->size < 4) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for path %u",
> + i);
> + return;
> + }
> +
> + if (!l2cap_frame_get_le24((void *)frame, &pct)) {
> + print_text(COLOR_ERROR, " PCT: invalid");
> + return;
> + }
> +
> + /* Extract 12-bit I and Q samples from 24-bit PCT */
> + i_sample = pct & 0x0FFF;
> + q_sample = (pct >> 12) & 0x0FFF;
> +
> + print_field(" Path %u", i);
> + print_field(" PCT: 0x%06x", pct);
> + print_field(" I: 0x%03x", i_sample);
> + print_field(" Q: 0x%03x", q_sample);
> +
> + if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
> + print_text(COLOR_ERROR,
> + " Tone quality indicator: "
> + "invalid size");
> + return;
> + }
> +
> + print_field(" Tone quality indicator: 0x%02x",
> + tone_quality);
> + print_field(" %s (0x%02x)",
> + tone_quality_str(tone_quality),
> + tone_quality & 0x03);
> + print_field(" %s (0x%02x)",
> + tone_extension_str(tone_quality),
> + (tone_quality >> 4) & 0x03);
> + }
> +}
> +
> +static void print_ranging_steps(const struct l2cap_frame *frame,
> + uint8_t num_steps, uint8_t num_antenna_paths)
> +{
> + uint8_t step_idx;
> +
> + for (step_idx = 0; step_idx < num_steps && frame->size > 0;
> + step_idx++) {
> + uint8_t mode_byte;
> + uint8_t mode_type;
> + bool aborted;
> + uint8_t step_data_len;
> +
> + if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
> + print_text(COLOR_ERROR,
> + " Step %u: Mode: invalid size",
> + step_idx);
> + return;
> + }
> +
> + mode_type = mode_byte & 0x03;
> + aborted = (mode_byte & 0x80) != 0;
> +
> + print_field(" Step %u", step_idx);
> + print_field(" Mode Type: %u", mode_type);
> + print_field(" Aborted: %s", aborted ? "Yes" : "No");
> +
> + /* If aborted, step data length is 0 */
> + if (aborted)
> + continue;
> +
> + /* Determine step data length based on mode type
> + * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
> + * (reflector)
> + * Mode 1: Always 6 bytes
> + * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
> + * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
> + * num_antenna_paths * 4 bytes
> + */
> + switch (mode_type) {
> + case 0:
> + /* Mode 0: Default to 3 bytes (reflector)
> + * Only use 5 bytes if we're the last step AND have
> + * exactly 5 bytes remaining
> + */
> + if (step_idx == num_steps - 1 && frame->size == 5) {
> + /* Initiator - last step with exactly 5 bytes */
> + step_data_len = 5;
> + } else if (frame->size >= 3) {
> + /* Reflector - default case */
> + step_data_len = 3;
> + } else {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 0");
> + return;
> + }
> + break;
> + case 1:
> + /* Mode 1: Always 6 bytes */
> + if (frame->size < 6) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 1");
> + return;
> + }
> + step_data_len = 6;
> + break;
> + case 2:
> + /* Mode 2: 1 byte antenna + num_antenna_paths * 4
> + * bytes per path
> + */
> + step_data_len = 1 + ((num_antenna_paths + 1) * 4);
> + if (frame->size < step_data_len) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 2 (need %u)",
> + step_data_len);
> + return;
> + }
> + break;
> + case 3:
> + /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
> + * num_antenna_paths * 4 bytes
> + */
> + step_data_len = 7 + ((num_antenna_paths + 1) * 4);
> + if (frame->size < step_data_len) {
> + print_text(COLOR_ERROR,
> + " Insufficient data for Mode 3 (need %u)",
> + step_data_len);
> + return;
> + }
> + break;
> + default:
> + print_text(COLOR_ERROR, " Unknown mode type");
> + return;
> + }
> +
> + if (step_data_len > frame->size) {
> + print_text(COLOR_ERROR,
> + " Invalid step data length");
> + return;
> + }
> +
> + if (step_data_len > 0) {
> + struct l2cap_frame step_frame;
> +
> + l2cap_frame_clone(&step_frame, frame);
> + step_frame.size = step_data_len;
> +
> + switch (mode_type) {
> + case 0:
> + print_step_mode_0(&step_frame, step_data_len);
> + break;
> + case 1:
> + print_step_mode_1(&step_frame, step_data_len);
> + break;
> + case 2:
> + print_step_mode_2(&step_frame, step_data_len,
> + num_antenna_paths);
> + break;
> + case 3:
> + print_step_mode_3(&step_frame, step_data_len,
> + num_antenna_paths);
> + break;
> + }
> +
> + if (!l2cap_frame_pull((void *)frame, frame,
> + step_data_len))
> + return;
> + }
> + }
> }
>
> static void ras_ranging_data_read(const struct l2cap_frame *frame)
> @@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
> print_ras_segmentation_header(seg_header);
>
> first_segment = seg_header & 0x01;
> -
> /* Only try to decode headers if this is the first segment */
> - if (first_segment && frame->size >= 6) {
> + if (first_segment && frame->size >= 4) {
> + uint8_t num_steps;
> + uint8_t num_antenna_paths;
> +
> print_field(" Ranging Data Body:");
> - print_ras_ranging_header(frame);
> + num_antenna_paths = print_ras_ranging_header(frame);
>
> /* Try to decode subevent header if enough data remains */
> - if (frame->size >= 10) {
> + if (frame->size >= 8) {
> print_field(" Subevent #0:");
> - print_ras_subevent_header(frame);
> + num_steps = print_ras_subevent_header(frame);
> +
> + /* Parse steps if we have num_steps and
> + * num_antenna_paths
> + */
> + if (num_steps > 0 && num_antenna_paths > 0 &&
> + frame->size > 0) {
> + print_ranging_steps((void *)frame, num_steps,
> + num_antenna_paths);
> + }
> }
> + } else if (!first_segment && frame->size > 0) {
> + /* For continuation segments, we cannot reliably decode without
> + * full segment reassembly, as steps may be split across
> + * segments.
> + * Just show the raw data.
> + */
> + print_field(" Continuation Segment (raw data - requires "
> + "reassembly for proper decoding):");
> + print_hex_field(" Segment Data", frame->data, frame->size);
> }
>
> - if (frame->size > 0) {
> - print_hex_field(" Remaining Ranging Data Segment", frame->data,
> - frame->size);
> - }
> + if (frame->size > 0 && first_segment)
> + print_hex_field(" Remaining Ranging Data Segment",
> + frame->data, frame->size);
>
> done:
> - if (frame->size)
> + if (frame->size && first_segment)
> print_hex_field(" Remaining Data", frame->data, frame->size);
> }
>
> --
> 2.34.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* [PATCH BlueZ v2] monitor: Add parsing of CS step mode data in RAS Notifications Subevent #0: Start ACL Connection Event: 406 Frequency Compensation: -16384 (0.01 ppm) Ranging Done Status: Partial results, more to follow (0x1) Subevent Done Status: All results complete (0x0) Ranging Abort Reason: No abort (0x0) Subevent Abort Reason: No abort (0x0) Reference Power Level: -14 dBm Number of Steps Reported: 58 Step 0 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -52 Packet Antenna: 1 Step 1 Mode Type: 0 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet RSSI: -48 Packet Antenna: 1 Step 2 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -60 ToA_ToD: 0xffffff45 Packet Antenna: 1 Step 3 Mode Type: 1 Aborted: No Packet Quality: 0x00 CS Access Address check is successful, and all bits match the expected sequence Bit errors: 0 Packet NADM: Unknown NADM (0xff) Packet RSSI: -54 ToA_ToD: 0xffffff53 Packet Antenna: 1
From: Prathibha Madugonde @ 2026-05-07 18:07 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
---
monitor/att.c | 521 ++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 500 insertions(+), 21 deletions(-)
diff --git a/monitor/att.c b/monitor/att.c
index 03d46634f..c8915ab04 100644
--- a/monitor/att.c
+++ b/monitor/att.c
@@ -4120,16 +4120,18 @@ static void print_ras_segmentation_header(uint8_t header)
print_field(" Segment Index: %u", segment_index);
}
-static void print_ras_ranging_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_ranging_header(const struct l2cap_frame *frame)
{
uint16_t ranging_counter_config;
uint8_t selected_tx_power;
uint8_t antenna_paths_mask;
uint8_t mask;
+ uint8_t num_antenna_paths = 0;
+ uint8_t i;
if (!l2cap_frame_get_le16((void *)frame, &ranging_counter_config)) {
print_text(COLOR_ERROR, " Ranging Header: invalid size");
- return;
+ return 0;
}
/* Lower 12 bits: Ranging Counter, Upper 4 bits: Configuration ID */
@@ -4140,14 +4142,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &selected_tx_power)) {
print_text(COLOR_ERROR, " Selected TX Power: invalid size");
- return;
+ return 0;
}
print_field(" Selected TX Power: %d dBm", (int8_t)selected_tx_power);
if (!l2cap_frame_get_u8((void *)frame, &antenna_paths_mask)) {
print_text(COLOR_ERROR, " Antenna Paths Mask: invalid size");
- return;
+ return 0;
}
print_field(" Antenna Paths Mask: 0x%2.2x", antenna_paths_mask);
@@ -4157,6 +4159,14 @@ static void print_ras_ranging_header(const struct l2cap_frame *frame)
if (mask)
print_text(COLOR_WHITE_BG, " RFU (0x%2.2x)", mask);
+
+ /* Count the number of set bits in antenna_paths_mask */
+ for (i = 0; i < 4; i++) {
+ if (antenna_paths_mask & (1 << i))
+ num_antenna_paths++;
+ }
+
+ return num_antenna_paths;
}
static const char *ras_ranging_done_status_str(uint8_t status)
@@ -4203,7 +4213,7 @@ static const char *ras_abort_reason_str(uint8_t reason)
}
}
-static void print_ras_subevent_header(const struct l2cap_frame *frame)
+static uint8_t print_ras_subevent_header(const struct l2cap_frame *frame)
{
uint16_t start_acl_conn_event;
uint16_t freq_compensation;
@@ -4216,7 +4226,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &start_acl_conn_event)) {
print_text(COLOR_ERROR,
" Start ACL Connection Event: invalid size");
- return;
+ return 0;
}
print_field(" Start ACL Connection Event: %u",
@@ -4225,7 +4235,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_le16((void *)frame, &freq_compensation)) {
print_text(COLOR_ERROR,
" Frequency Compensation: invalid size");
- return;
+ return 0;
}
print_field(" Frequency Compensation: %d (0.01 ppm)",
@@ -4233,7 +4243,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte1)) {
print_text(COLOR_ERROR, " Status: invalid size");
- return;
+ return 0;
}
ranging_done_status = status_byte1 & 0x0F;
@@ -4248,7 +4258,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &status_byte2)) {
print_text(COLOR_ERROR, " Abort Reasons: invalid size");
- return;
+ return 0;
}
ranging_abort_reason = status_byte2 & 0x0F;
@@ -4264,7 +4274,7 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &ref_power_level)) {
print_text(COLOR_ERROR,
" Reference Power Level: invalid size");
- return;
+ return 0;
}
print_field(" Reference Power Level: %d dBm",
@@ -4273,10 +4283,460 @@ static void print_ras_subevent_header(const struct l2cap_frame *frame)
if (!l2cap_frame_get_u8((void *)frame, &num_steps_reported)) {
print_text(COLOR_ERROR,
" Number of Steps Reported: invalid size");
- return;
+ return 0;
}
print_field(" Number of Steps Reported: %u", num_steps_reported);
+
+ return num_steps_reported;
+}
+
+static const char *packet_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "CS Access Address check is successful, and all bits "
+ "match the expected sequence";
+ case 0x01:
+ return "CS Access Address check is successful, but some bits "
+ "do not match the expected sequence";
+ case 0x02:
+ return "CS Access Address check failed";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_quality_str(uint8_t quality)
+{
+ switch (quality & 0x03) {
+ case 0x00:
+ return "Tone quality is high";
+ case 0x01:
+ return "Tone quality is medium";
+ case 0x02:
+ return "Tone quality is low";
+ case 0x03:
+ return "Tone quality indication is not available";
+ default:
+ return "Reserved";
+ }
+}
+
+static const char *tone_extension_str(uint8_t quality)
+{
+ switch ((quality >> 4) & 0x03) {
+ case 0x00:
+ return "Not tone extension slot";
+ case 0x01:
+ return "Tone extension slot; tone not expected to be present";
+ case 0x02:
+ return "Tone extension slot; tone expected to be present";
+ default:
+ return "Reserved";
+ }
+}
+
+static void print_step_mode_0(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, rssi, antenna;
+ uint16_t freq_offset;
+
+ if (len < 3) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR,
+ " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ if (len == 5) {
+ if (!l2cap_frame_get_le16((void *)frame, &freq_offset)) {
+ print_text(COLOR_ERROR,
+ " Measured Freq Offset: invalid size");
+ return;
+ }
+
+ print_field(" Measured Freq Offset: %d (0.01 ppm)",
+ (int16_t)freq_offset);
+ }
+}
+
+static void print_step_mode_1(const struct l2cap_frame *frame, uint8_t len)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+}
+
+static void print_step_mode_2(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t quality;
+
+ if (len < 1) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(quality),
+ quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(quality),
+ (quality >> 4) & 0x03);
+ }
+}
+
+static void print_step_mode_3(const struct l2cap_frame *frame, uint8_t len,
+ uint8_t num_antenna_paths)
+{
+ uint8_t quality, nadm, rssi, antenna;
+ uint16_t toa_tod;
+ uint8_t ant_perm_idx;
+ uint8_t i;
+ uint32_t pct;
+ uint16_t i_sample, q_sample;
+ uint8_t tone_quality;
+
+ /* Mode 3 = Mode 1 (6 bytes) + Mode 2 (variable) */
+ if (len < 6) {
+ print_hex_field(" Raw step data", frame->data, len);
+ return;
+ }
+
+ /* Parse Mode 1 data first */
+ if (!l2cap_frame_get_u8((void *)frame, &quality)) {
+ print_text(COLOR_ERROR, " Packet Quality: invalid");
+ return;
+ }
+
+ print_field(" Packet Quality: 0x%02x", quality);
+ print_field(" %s", packet_quality_str(quality));
+ print_field(" Bit errors: %u", (quality >> 2) & 0x3F);
+
+ if (!l2cap_frame_get_u8((void *)frame, &nadm)) {
+ print_text(COLOR_ERROR, " Packet NADM: invalid size");
+ return;
+ }
+
+ if (nadm == 0xFF)
+ print_field(" Packet NADM: Unknown NADM (0xff)");
+ else
+ print_field(" Packet NADM: %u", nadm);
+
+ if (!l2cap_frame_get_u8((void *)frame, &rssi)) {
+ print_text(COLOR_ERROR, " Packet RSSI: invalid size");
+ return;
+ }
+
+ print_field(" Packet RSSI: %d", (int8_t)rssi);
+
+ if (!l2cap_frame_get_le16((void *)frame, &toa_tod)) {
+ print_text(COLOR_ERROR, " ToA_ToD: invalid size");
+ return;
+ }
+
+ print_field(" ToA_ToD: 0x%08x", toa_tod | 0xFFFF0000);
+
+ if (!l2cap_frame_get_u8((void *)frame, &antenna)) {
+ print_text(COLOR_ERROR, " Packet Antenna: invalid");
+ return;
+ }
+
+ print_field(" Packet Antenna: %u", antenna);
+
+ /* Now parse Mode 2 data */
+ if (frame->size < 1)
+ return;
+
+ if (!l2cap_frame_get_u8((void *)frame, &ant_perm_idx)) {
+ print_text(COLOR_ERROR, " Antenna Permutation Index: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Antenna Permutation Index: %u", ant_perm_idx);
+
+ /* Use the antenna paths count from ranging header */
+ for (i = 0; i < (num_antenna_paths + 1); i++) {
+ if (frame->size < 4) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for path %u",
+ i);
+ return;
+ }
+
+ if (!l2cap_frame_get_le24((void *)frame, &pct)) {
+ print_text(COLOR_ERROR, " PCT: invalid");
+ return;
+ }
+
+ /* Extract 12-bit I and Q samples from 24-bit PCT */
+ i_sample = pct & 0x0FFF;
+ q_sample = (pct >> 12) & 0x0FFF;
+
+ print_field(" Path %u", i);
+ print_field(" PCT: 0x%06x", pct);
+ print_field(" I: 0x%03x", i_sample);
+ print_field(" Q: 0x%03x", q_sample);
+
+ if (!l2cap_frame_get_u8((void *)frame, &tone_quality)) {
+ print_text(COLOR_ERROR,
+ " Tone quality indicator: "
+ "invalid size");
+ return;
+ }
+
+ print_field(" Tone quality indicator: 0x%02x",
+ tone_quality);
+ print_field(" %s (0x%02x)",
+ tone_quality_str(tone_quality),
+ tone_quality & 0x03);
+ print_field(" %s (0x%02x)",
+ tone_extension_str(tone_quality),
+ (tone_quality >> 4) & 0x03);
+ }
+}
+
+static void print_ranging_steps(const struct l2cap_frame *frame,
+ uint8_t num_steps, uint8_t num_antenna_paths)
+{
+ uint8_t step_idx;
+
+ for (step_idx = 0; step_idx < num_steps && frame->size > 0;
+ step_idx++) {
+ uint8_t mode_byte;
+ uint8_t mode_type;
+ bool aborted;
+ uint8_t step_data_len;
+
+ if (!l2cap_frame_get_u8((void *)frame, &mode_byte)) {
+ print_text(COLOR_ERROR,
+ " Step %u: Mode: invalid size",
+ step_idx);
+ return;
+ }
+
+ mode_type = mode_byte & 0x03;
+ aborted = (mode_byte & 0x80) != 0;
+
+ print_field(" Step %u", step_idx);
+ print_field(" Mode Type: %u", mode_type);
+ print_field(" Aborted: %s", aborted ? "Yes" : "No");
+
+ /* If aborted, step data length is 0 */
+ if (aborted)
+ continue;
+
+ /* Determine step data length based on mode type
+ * Mode 0: Check if we have 5 bytes (initiator) or 3 bytes
+ * (reflector)
+ * Mode 1: Always 6 bytes
+ * Mode 2: 1 byte (ant_perm_idx) + num_antenna_paths * 4 bytes
+ * Mode 3: 6 bytes (Mode 1) + 1 byte (ant_perm_idx) +
+ * num_antenna_paths * 4 bytes
+ */
+ switch (mode_type) {
+ case 0:
+ /* Mode 0: Default to 3 bytes (reflector)
+ * Only use 5 bytes if we're the last step AND have
+ * exactly 5 bytes remaining
+ */
+ if (step_idx == num_steps - 1 && frame->size == 5) {
+ /* Initiator - last step with exactly 5 bytes */
+ step_data_len = 5;
+ } else if (frame->size >= 3) {
+ /* Reflector - default case */
+ step_data_len = 3;
+ } else {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 0");
+ return;
+ }
+ break;
+ case 1:
+ /* Mode 1: Always 6 bytes */
+ if (frame->size < 6) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 1");
+ return;
+ }
+ step_data_len = 6;
+ break;
+ case 2:
+ /* Mode 2: 1 byte antenna + num_antenna_paths * 4
+ * bytes per path
+ */
+ step_data_len = 1 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 2 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ case 3:
+ /* Mode 3: 6 bytes Mode 1 + 1 byte antenna +
+ * num_antenna_paths * 4 bytes
+ */
+ step_data_len = 7 + ((num_antenna_paths + 1) * 4);
+ if (frame->size < step_data_len) {
+ print_text(COLOR_ERROR,
+ " Insufficient data for Mode 3 (need %u)",
+ step_data_len);
+ return;
+ }
+ break;
+ default:
+ print_text(COLOR_ERROR, " Unknown mode type");
+ return;
+ }
+
+ if (step_data_len > frame->size) {
+ print_text(COLOR_ERROR,
+ " Invalid step data length");
+ return;
+ }
+
+ if (step_data_len > 0) {
+ struct l2cap_frame step_frame;
+
+ l2cap_frame_clone(&step_frame, frame);
+ step_frame.size = step_data_len;
+
+ switch (mode_type) {
+ case 0:
+ print_step_mode_0(&step_frame, step_data_len);
+ break;
+ case 1:
+ print_step_mode_1(&step_frame, step_data_len);
+ break;
+ case 2:
+ print_step_mode_2(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ case 3:
+ print_step_mode_3(&step_frame, step_data_len,
+ num_antenna_paths);
+ break;
+ }
+
+ if (!l2cap_frame_pull((void *)frame, frame,
+ step_data_len))
+ return;
+ }
+ }
}
static void ras_ranging_data_read(const struct l2cap_frame *frame)
@@ -4292,26 +4752,45 @@ static void ras_ranging_data_read(const struct l2cap_frame *frame)
print_ras_segmentation_header(seg_header);
first_segment = seg_header & 0x01;
-
/* Only try to decode headers if this is the first segment */
- if (first_segment && frame->size >= 6) {
+ if (first_segment && frame->size >= 4) {
+ uint8_t num_steps;
+ uint8_t num_antenna_paths;
+
print_field(" Ranging Data Body:");
- print_ras_ranging_header(frame);
+ num_antenna_paths = print_ras_ranging_header(frame);
/* Try to decode subevent header if enough data remains */
- if (frame->size >= 10) {
+ if (frame->size >= 8) {
print_field(" Subevent #0:");
- print_ras_subevent_header(frame);
+ num_steps = print_ras_subevent_header(frame);
+
+ /* Parse steps if we have num_steps and
+ * num_antenna_paths
+ */
+ if (num_steps > 0 && num_antenna_paths > 0 &&
+ frame->size > 0) {
+ print_ranging_steps((void *)frame, num_steps,
+ num_antenna_paths);
+ }
}
+ } else if (!first_segment && frame->size > 0) {
+ /* For continuation segments, we cannot reliably decode without
+ * full segment reassembly, as steps may be split across
+ * segments.
+ * Just show the raw data.
+ */
+ print_field(" Continuation Segment (raw data - requires "
+ "reassembly for proper decoding):");
+ print_hex_field(" Segment Data", frame->data, frame->size);
}
- if (frame->size > 0) {
- print_hex_field(" Remaining Ranging Data Segment", frame->data,
- frame->size);
- }
+ if (frame->size > 0 && first_segment)
+ print_hex_field(" Remaining Ranging Data Segment",
+ frame->data, frame->size);
done:
- if (frame->size)
+ if (frame->size && first_segment)
print_hex_field(" Remaining Data", frame->data, frame->size);
}
--
2.34.1
^ permalink raw reply related
* Re: [PATCH BlueZ] bap: Fix typo in QoS D-Bus dictionary entry names
From: patchwork-bot+bluetooth @ 2026-05-07 17:50 UTC (permalink / raw)
To: Thomas Kirschner; +Cc: linux-bluetooth
In-Reply-To: <20260506230051.27436-1-thomaskirschner85@yahoo.de>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 7 May 2026 01:00:51 +0200 you wrote:
> MinimumDelay and PreferredMinimumDelay had wrong spelling, causing
> them to be exposed incorrectly over D-Bus. Any client relying on
> the correct spelling would fail to find these entries, breaking
> LE Audio QoS negotiation.
> ---
> profiles/audio/bap.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Here is the summary with links:
- [BlueZ] bap: Fix typo in QoS D-Bus dictionary entry names
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d45fd43a1cc3
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* RE: [BlueZ] client/btpclient: Add BTP_EV_GAP_SEC_LEVEL_CHANGED support
From: bluez.test.bot @ 2026-05-07 17:50 UTC (permalink / raw)
To: linux-bluetooth, frederic.danis
In-Reply-To: <20260507161633.437600-1-frederic.danis@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 826 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1091167
---Test result---
Test Summary:
CheckPatch PASS 0.44 seconds
GitLint PASS 0.29 seconds
BuildEll PASS 20.26 seconds
BluezMake PASS 652.26 seconds
CheckSmatch PASS 351.90 seconds
bluezmakeextell PASS 183.13 seconds
IncrementalBuild PASS 657.53 seconds
ScanBuild PASS 1021.35 seconds
https://github.com/bluez/bluez/pull/2106
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH v4 2/2] Bluetooth: MGMT: Add SCI setting bit(25)
From: Luiz Augusto von Dentz @ 2026-05-07 17:42 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260507174205.209488-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds MGMT_SETTING_SCI(25) which indicates that the controller is
support SCI feature.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci_core.h | 2 ++
include/net/bluetooth/mgmt.h | 1 +
net/bluetooth/mgmt.c | 6 ++++++
3 files changed, 9 insertions(+)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 61872403fe65..84a1ee798da1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2094,6 +2094,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
/* Shorter Connection Intervals support */
#define le_sci_capable(dev) \
((dev)->le_features[9] & HCI_LE_SCI)
+#define le_sci_enabled(dev) \
+ (le_enabled(dev) && le_sci_capable(dev))
void hci_sci_groups_clear(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 8234915854b6..dfd264f0bac7 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -121,6 +121,7 @@ struct mgmt_rp_read_index_list {
#define MGMT_SETTING_LL_PRIVACY BIT(22)
#define MGMT_SETTING_PAST_SENDER BIT(23)
#define MGMT_SETTING_PAST_RECEIVER BIT(24)
+#define MGMT_SETTING_SCI BIT(25)
#define MGMT_OP_READ_INFO 0x0004
#define MGMT_READ_INFO_SIZE 0
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index b05bb380e5f8..1ea06ae1efdc 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -864,6 +864,9 @@ static u32 get_supported_settings(struct hci_dev *hdev)
if (past_receiver_capable(hdev))
settings |= MGMT_SETTING_PAST_RECEIVER;
+ if (le_sci_capable(hdev))
+ settings |= MGMT_SETTING_SCI;
+
settings |= MGMT_SETTING_PHY_CONFIGURATION;
return settings;
@@ -955,6 +958,9 @@ static u32 get_current_settings(struct hci_dev *hdev)
if (past_receiver_enabled(hdev))
settings |= MGMT_SETTING_PAST_RECEIVER;
+ if (le_sci_enabled(hdev))
+ settings |= MGMT_SETTING_SCI;
+
return settings;
}
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox