* [PATCH BlueZ v5 16/16] test: functional: add basic obex file transfer tests
From: Pauli Virtanen @ 2026-05-13 16:17 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778688966.git.pav@iki.fi>
Add tests for Obex DBus API and obexctl
test/functional/test_obex.py::test_obex_ftp_get
test/functional/test_obex.py::test_obex_ftp_list
test/functional/test_obex.py::test_obexctl_list
---
test/functional/test_obex.py | 285 +++++++++++++++++++++++++++++++++++
1 file changed, 285 insertions(+)
create mode 100644 test/functional/test_obex.py
diff --git a/test/functional/test_obex.py b/test/functional/test_obex.py
new file mode 100644
index 000000000..fcb9105e5
--- /dev/null
+++ b/test/functional/test_obex.py
@@ -0,0 +1,285 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: LGPL-2.1-or-later
+"""
+Tests for Obex
+"""
+import sys
+import os
+import re
+import pytest
+import subprocess
+import tempfile
+import time
+import logging
+import json
+import dbus
+import threading
+from pathlib import Path
+
+import pytest
+
+from pytest_bluezenv import (
+ HostPlugin,
+ Agent,
+ host_config,
+ find_exe,
+ Bluetoothd,
+ Bluetoothctl,
+ Obexd,
+ LogStream,
+ wait_until,
+ mainloop_wrap,
+ mainloop_assert,
+ Event,
+ EventPluginMixin,
+ dbus_service_event_method,
+ Pexpect,
+ utils,
+)
+
+pytestmark = [pytest.mark.vm]
+
+log = logging.getLogger(__name__)
+
+
+BUS_NAME = "org.bluez.obex"
+PATH = "/org/bluez/obex"
+AGENT_MANAGER_INTERFACE = "org.bluez.obex.AgentManager1"
+AGENT_INTERFACE = "org.bluez.obex.Agent1"
+CLIENT_INTERFACE = "org.bluez.obex.Client1"
+SESSION_INTERFACE = "org.bluez.obex.Session1"
+FILE_TRANSFER_INTERFACE = "org.bluez.obex.FileTransfer1"
+TRANSFER_INTERFACE = "org.bluez.obex.Transfer1"
+
+FTP_UUID = "00001106-0000-1000-8000-00805f9b34fb"
+
+
+class ObexAgent(HostPlugin, EventPluginMixin):
+ depends = [Bluetoothd()]
+ name = "obex_agent"
+
+ def __init__(self, path="/obexagent"):
+ self.path = path
+
+ @mainloop_wrap
+ def setup(self, impl):
+ EventPluginMixin.setup(self, impl)
+
+ self.bus = dbus.SessionBus()
+ self.bus.set_exit_on_disconnect(False)
+
+ self.agent = ObexAgentObject(self.bus, self.path, self.events)
+
+ bluez = self.bus.get_object(BUS_NAME, PATH)
+ self.manager = dbus.Interface(bluez, AGENT_MANAGER_INTERFACE)
+ self.manager.RegisterAgent(self.path)
+
+ log.info("Obex agent registered")
+
+ def cleanup(self):
+ path = Path("/run/obex")
+ for f in path.iterdir():
+ f.unlink()
+
+
+def agent_method(*a, **kw):
+ return dbus_service_event_method(AGENT_INTERFACE, *a, **kw)
+
+
+class ObexAgentObject(dbus.service.Object):
+ @mainloop_assert
+ def __init__(self, bus, path, events):
+ self.events = events
+ super().__init__(bus, path)
+
+ AuthorizePush = agent_method("AuthorizePush", ("path",), "o", "s", sync=False)
+ Cancel = agent_method("Cancel")
+
+
+def write_obex_file(name, content):
+ with open(f"/run/obex/{name}", "w") as f:
+ f.write(content)
+
+
+def read_file(name):
+ with open(name, "r") as f:
+ return f.read()
+
+
+#
+# Direct Obex Python client API tests
+#
+
+
+class ObexClient(HostPlugin, EventPluginMixin):
+ name = "obex"
+
+ @mainloop_wrap
+ def setup(self, impl):
+ EventPluginMixin.setup(self, impl)
+
+ self.transferred = 0
+ self.transfer_path = None
+ self.transfer_size = 0
+
+ self.bus = dbus.SessionBus()
+ self.bus.set_exit_on_disconnect(False)
+ self.log = logging.getLogger(self.name)
+ self.client = dbus.Interface(
+ self.bus.get_object(BUS_NAME, PATH), CLIENT_INTERFACE
+ )
+
+ self.bus.add_signal_receiver(
+ self.properties_changed,
+ dbus_interface="org.freedesktop.DBus.Properties",
+ signal_name="PropertiesChanged",
+ path_keyword="path",
+ )
+
+ @mainloop_wrap
+ def connect(self, bdaddr):
+ def reply(path):
+ obj = self.bus.get_object(BUS_NAME, path)
+ self.session = dbus.Interface(obj, SESSION_INTERFACE)
+ self.ftp = dbus.Interface(obj, FILE_TRANSFER_INTERFACE)
+
+ self._object_method(
+ self.client, "CreateSession", bdaddr, {"Target": "ftp"}, reply_handler=reply
+ )
+
+ @mainloop_assert
+ def properties_changed(self, interface, properties, invalidated, path):
+ if path != self.transfer_path:
+ return
+
+ if "Status" in properties and (
+ properties["Status"] == "complete" or properties["Status"] == "error"
+ ):
+ self.events.put(
+ Event(
+ f"{FILE_TRANSFER_INTERFACE}:{properties['Status']}",
+ properties=properties,
+ )
+ )
+ self.log.debug(f"Transfer {properties['Status']}")
+
+ if "Transferred" not in properties:
+ return
+
+ value = properties["Transferred"]
+ speed = (value - self.transferred) / 1000
+ self.log.debug(
+ f"Transfer progress {value}/{self.transfer_size} at {speed} kBps"
+ )
+ self.transferred = value
+
+ @mainloop_wrap
+ def ftp_list_folder(self):
+ return self.ftp.ListFolder()
+
+ @mainloop_wrap
+ def ftp_get_file(self, dst, src):
+ path, properties = self.ftp.GetFile(dst, src)
+ self.transfer_path = path
+ self.transfer_size = properties["Size"]
+ return properties["Filename"]
+
+
+@pytest.fixture
+def paired_hosts(hosts):
+ from .test_agent import test_agent_pair_bredr
+
+ if hosts[0].agent.has_device(hosts[1].bdaddr):
+ return hosts
+
+ test_agent_pair_bredr(hosts, True)
+ return hosts
+
+
+obex_host_config = host_config(
+ [Agent(), Obexd(), ObexClient(), Pexpect()],
+ [Agent(), Obexd(), ObexAgent()],
+ reuse=True,
+)
+
+
+@pytest.fixture
+def obex_hosts(paired_hosts):
+ host0, host1 = paired_hosts
+
+ if hasattr(host0, "session"):
+ return paired_hosts
+
+ host0.obex.connect(host1.bdaddr)
+
+ service = host1.agent.expect("org.bluez.Agent1.AuthorizeService")
+ assert service.uuid == FTP_UUID
+ host1.agent.reply()
+
+ host0.obex.expect("org.bluez.obex.Client1.CreateSession:reply")
+
+ yield paired_hosts
+
+ host1.obex_agent.cleanup()
+
+
+@obex_host_config
+def test_obex_ftp_list(obex_hosts):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ (item,) = host0.obex.ftp_list_folder()
+ assert item["Type"] == "file"
+ assert item["Name"] == "test"
+ assert item["Size"] == 4
+
+
+@obex_host_config
+def test_obex_ftp_get(obex_hosts):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ filename = host0.obex.ftp_get_file("", "test")
+ host0.obex.expect("org.bluez.obex.FileTransfer1:complete")
+ assert host0.call(read_file, filename) == "1234"
+
+
+#
+# obexctl tests
+#
+
+
+@pytest.fixture
+def obexctl(obex_hosts):
+ host0, host1 = obex_hosts
+
+ exe = find_exe("tools", "obexctl")
+ obexctl = host0.pexpect.spawn([exe])
+
+ obexctl.expect("Client /org/bluez/obex")
+ obexctl.send(f"connect {host1.bdaddr} {FTP_UUID}\n")
+
+ service = host1.agent.expect("org.bluez.Agent1.AuthorizeService")
+ assert service.uuid == FTP_UUID
+ host1.agent.reply()
+
+ obexctl.expect("Connection successful")
+ obexctl.send(f"select /org/bluez/obex/client/session1\n")
+
+ yield obexctl
+
+ obexctl.close()
+
+
+@obex_host_config
+def test_obexctl_list(obex_hosts, obexctl):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ obexctl.send(f"ls\n")
+ obexctl.expect(f"Type: file")
+ obexctl.expect(f"Name: test")
+ obexctl.expect(f"Size: 4")
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v5 15/16] test: functional: add some Agent1 interface tests
From: Pauli Virtanen @ 2026-05-13 16:17 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1778688966.git.pav@iki.fi>
Add test
test/functional/test_agent.py::test_agent_pair_bredr
---
test/functional/test_agent.py | 46 +++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
create mode 100644 test/functional/test_agent.py
diff --git a/test/functional/test_agent.py b/test/functional/test_agent.py
new file mode 100644
index 000000000..24593090b
--- /dev/null
+++ b/test/functional/test_agent.py
@@ -0,0 +1,46 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for bluetoothctl using VM instances
+"""
+import sys
+import re
+import pytest
+import subprocess
+import tempfile
+
+import time
+import logging
+
+
+from pytest_bluezenv import host_config, Agent, wait_until
+
+pytestmark = [pytest.mark.vm]
+
+
+@host_config([Agent()], [Agent()])
+@pytest.mark.parametrize("success", [True, False], ids=["accept", "reject"])
+def test_agent_pair_bredr(hosts, success):
+ host0, host1 = hosts
+
+ host0.agent.adapter_method("StartDiscovery")
+ host0.agent.expect("org.bluez.Adapter1.StartDiscovery:reply")
+
+ host1.agent.adapter_set("Pairable", True)
+ host1.agent.adapter_set("Discoverable", True)
+
+ wait_until(host0.agent.has_device, host1.bdaddr)
+
+ host0.agent.device_method(host1.bdaddr, "Pair")
+
+ confirm_0 = host0.agent.expect("org.bluez.Agent1.RequestConfirmation")
+ confirm_1 = host1.agent.expect("org.bluez.Agent1.RequestConfirmation")
+ assert confirm_0.passkey == confirm_1.passkey
+ host0.agent.reply()
+
+ if success:
+ host1.agent.reply()
+ host0.agent.expect("org.bluez.Device1.Pair:reply")
+ else:
+ host1.agent.reply_error()
+ host0.agent.expect("org.bluez.Device1.Pair:error")
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v2 0/1] shared/bap: set QoS state when CIS is lost
From: raghu447 @ 2026-05-13 16:34 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghu447
In-Reply-To: <CABBYNZLcvmErUXHUXnAJOMv+saSP7aodVtfRV0QnL2-yXg=z2w@mail.gmail.com>
This is used to pass PTS tests BAP/USR/SCC/BV-167-C and BAP/USR/SCC/BV-168-C.
raghavendra (1):
shared/bap: set QoS state when CIS is lost
src/shared/bap.c | 4 ++++
1 file changed, 4 insertions(+)
--
2.43.0
^ permalink raw reply
* [PATCH BlueZ v2 1/1] shared/bap: set QoS state when CIS is lost
From: raghu447 @ 2026-05-13 16:34 UTC (permalink / raw)
To: linux-bluetooth; +Cc: raghavendra
In-Reply-To: <20260513163435.11344-1-raghavendra.rao@collabora.com>
From: raghavendra <raghavendra.rao@collabora.com>
This is used to pass PTS tests BAP/USR/SCC/BV-167-C and BAP/USR/SCC/BV-168-C.
---
src/shared/bap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/shared/bap.c b/src/shared/bap.c
index 78ba22259..60710a806 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -3028,6 +3028,10 @@ static void bap_stream_set_io(void *data, void *user_data)
else
bt_bap_stream_start(stream, NULL, NULL);
break;
+ case BT_BAP_STREAM_STATE_STREAMING:
+ if (fd < 0)
+ stream_set_state(stream, BT_BAP_STREAM_STATE_QOS);
+ break;
case BT_BAP_STREAM_STATE_DISABLING:
if (fd < 0)
bt_bap_stream_stop(stream, NULL, NULL);
--
2.43.0
^ permalink raw reply related
* [bluez/bluez] 57ef69: emulator: btvirt: check pkt lengths, don't get stu...
From: Pauli Virtanen @ 2026-05-13 17:28 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1094320
Home: https://github.com/bluez/bluez
Commit: 57ef69b7882151f5e6d94e9be8e3902277f81c80
https://github.com/bluez/bluez/commit/57ef69b7882151f5e6d94e9be8e3902277f81c80
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M emulator/server.c
Log Message:
-----------
emulator: btvirt: check pkt lengths, don't get stuck on malformed
Don't try to parse packet before whole header is received.
If received data has unknown packet type, reset buffer so that we don't
get stuck.
Commit: 639f99a94734bcc1eb812a8d9dbf4e776017287e
https://github.com/bluez/bluez/commit/639f99a94734bcc1eb812a8d9dbf4e776017287e
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M emulator/main.c
Log Message:
-----------
emulator: btvirt: allow specifying where server unix sockets are made
Make --server to take optional path name where to create the various
server sockets.
Commit: ad264c862239892f0d9965b0b679ae36c88b5777
https://github.com/bluez/bluez/commit/ad264c862239892f0d9965b0b679ae36c88b5777
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M emulator/server.c
Log Message:
-----------
emulator: btvirt: support SCO data packets
Support also SCO data packets in btvirt.
Commit: 2bf4030bb151631b24a425a82bddc8f3b2649595
https://github.com/bluez/bluez/commit/2bf4030bb151631b24a425a82bddc8f3b2649595
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M emulator/btdev.c
Log Message:
-----------
emulator: btdev: clear more state on Reset
On controller Reset command, initialize most fields in struct btdev to
zero, similarly to the state just after btdev_create().
This excludes some fields like command bitmasks, which hciemu may have
adjusted.
To make this easier, add struct_group() macro similar to what kernel
uses.
Commit: cf32208ed16e44e89474f4faa67293261641b208
https://github.com/bluez/bluez/commit/cf32208ed16e44e89474f4faa67293261641b208
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M tools/test-runner.c
Log Message:
-----------
test-runner: enable path argument for --unix
Allow specifying the path for the controller socket to be used.
Commit: eef206c5e2f6291febea934eeb08d20ec3ff02b3
https://github.com/bluez/bluez/commit/eef206c5e2f6291febea934eeb08d20ec3ff02b3
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M tools/test-runner.c
Log Message:
-----------
test-runner: Add -o/--option option
Allow passing arbitrary arguments to QEMU.
Commit: c0775bb788bdabecc573224b3d218c5e8348a38b
https://github.com/bluez/bluez/commit/c0775bb788bdabecc573224b3d218c5e8348a38b
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M tools/test-runner.c
Log Message:
-----------
test-runner: allow source tree root for -k
Allow passing source tree root for -k option, look up kernel below it.
Commit: f1e9b638a13c9893f4c29d6c958fbf5f9303f1cc
https://github.com/bluez/bluez/commit/f1e9b638a13c9893f4c29d6c958fbf5f9303f1cc
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M tools/test-runner.c
Log Message:
-----------
test-runner: use virtio-serial for implementing -u device forwarding
Using pci-serial to forward eg. btvirt sockets is unreliable, as qemu or
kernel seems to be sometimes dropping part of the sent data or insert
spurious \0 bytes, leading to sporadic errors like:
kernel: Bluetooth: hci0: command 0x0c52 tx timeout
kernel: Bluetooth: hci0: Opcode 0x0c52 failed: -110
btvirt: packet error, unknown type: 0
This appears to occur most often when host system is under load, e.g.
due to multiple test-runners running at the same time. The problem is
not specific to btvirt, but seems to be in the qemu serial device layer
vs. kernel interaction.
Change test-runner to use virtserialport to forward the btvirt
connection inside the VM, as virtio-serial doesn't appear to have these
problems.
Commit: a7947e84803d743fdb53948964f71ed312da4038
https://github.com/bluez/bluez/commit/a7947e84803d743fdb53948964f71ed312da4038
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M doc/ci.config
M doc/test-runner.rst
M doc/tester.config
Log Message:
-----------
doc: enable CONFIG_VIRTIO_CONSOLE in tester config
Enable kernel option that allows using -device virtserialport in qemu.
This is easier to make work reliably than pci-serial channel.
Commit: 24d0b8f8ec6b7c4f0a52b004bbf94063cda40af5
https://github.com/bluez/bluez/commit/24d0b8f8ec6b7c4f0a52b004bbf94063cda40af5
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M doc/ci.config
M doc/test-runner.rst
M doc/tester.config
Log Message:
-----------
doc: enable KVM paravirtualization & clock support in tester kernel config
Enable KVM guest and PTP options in tester kernel config.
This allows synchronizing tester VM guest with host clock, needed for
testers that want to compare timestamps outside the VM guest.
Commit: f106db3fc469d7a7e12997b0ec588b3090c21a03
https://github.com/bluez/bluez/commit/f106db3fc469d7a7e12997b0ec588b3090c21a03
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A doc/test-functional.rst
Log Message:
-----------
doc: add functional/integration testing documentation
Add documentation for functional/integration test suite.
Commit: 79314e1cd2bb69b5cb9178754bec2136e6bd3f8c
https://github.com/bluez/bluez/commit/79314e1cd2bb69b5cb9178754bec2136e6bd3f8c
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A test/functional/__init__.py
A test/functional/conftest.py
A test/functional/requirements.txt
A test/functional/test_bluetoothctl_vm.py
A test/functional/test_btmgmt_vm.py
A test/pytest.ini
A test/test-functional
A test/test-functional-attach
Log Message:
-----------
test: add functional/integration testing framework
Add framework for writing tests simulating "real" environments where
BlueZ and other parts of the stack run on different virtual machine
hosts that communicate with each other.
Add some smoke tests for bluetoothctl and btmgmt.
The implementation for the VM setup is maintained separately in the
pytest-bluezenv plugin, https://pypi.org/project/pytest-bluezenv
Implements:
- RPC communication with tester instances running each of the VM hosts,
so that tests can be written on the parent host which coordinates the
execution.
- Extensible way to add stateful test-specific code inside the VM
instances
- Logging control: output from different processes running inside the VM
are separated and can be filtered.
- Test runner framework with Pytest, factored into a pytest plugin
- Grouping tests to minimize VM reboots
- Redirecting USB controllers to use for testing
There is no requirement that the tests spawn VM instances.
Commit: c0146e6abc9005ce88f23c625aac786a83c51d8c
https://github.com/bluez/bluez/commit/c0146e6abc9005ce88f23c625aac786a83c51d8c
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M Makefile.am
M configure.ac
Log Message:
-----------
build: add functional testing target
This adds check-functional: target that runs the functional test suite.
Also add a --enable-functional-testing=<kernel-image> argument for
configure that can be used to include it in the check: make target,
possibly with a predefined kernel image.
Commit: e4b50e8d1946995bb2d9ff46a7d4183b19e08c78
https://github.com/bluez/bluez/commit/e4b50e8d1946995bb2d9ff46a7d4183b19e08c78
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A test/functional/test_tests.py
Log Message:
-----------
test: functional: impose Python code formatting
Check Python code formatting of the functional test suite.
Commit: ba02713d7ebd2af3419b22fc0b0b49b503ceb7fe
https://github.com/bluez/bluez/commit/ba02713d7ebd2af3419b22fc0b0b49b503ceb7fe
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A test/functional/test_agent.py
Log Message:
-----------
test: functional: add some Agent1 interface tests
Add test
test/functional/test_agent.py::test_agent_pair_bredr
Commit: d2d05811090238ea21fe52e00942c57d6b7546de
https://github.com/bluez/bluez/commit/d2d05811090238ea21fe52e00942c57d6b7546de
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A test/functional/test_obex.py
Log Message:
-----------
test: functional: add basic obex file transfer tests
Add tests for Obex DBus API and obexctl
test/functional/test_obex.py::test_obex_ftp_get
test/functional/test_obex.py::test_obex_ftp_list
test/functional/test_obex.py::test_obexctl_list
Compare: https://github.com/bluez/bluez/compare/57ef69b78821%5E...d2d058110902
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] f91af1: shared/bap: set QoS state when CIS is lost
From: raghava447 @ 2026-05-13 17:28 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1094333
Home: https://github.com/bluez/bluez
Commit: f91af1627fdca285e516f802c64a15b3e27b2c3f
https://github.com/bluez/bluez/commit/f91af1627fdca285e516f802c64a15b3e27b2c3f
Author: raghavendra <raghavendra.rao@collabora.com>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: set QoS state when CIS is lost
This is used to pass PTS tests BAP/USR/SCC/BV-167-C and BAP/USR/SCC/BV-168-C.
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH v3] Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
From: patchwork-bot+bluetooth @ 2026-05-13 17:30 UTC (permalink / raw)
To: Ravindra
Cc: linux-bluetooth, ravishankar.srivatsa, kiran.k,
chethan.tumkur.narayan
In-Reply-To: <20260512083444.1214935-1-ravindra@intel.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 12 May 2026 14:04:44 +0530 you wrote:
> Device from /sys/kernel/debug/usb/devices:
>
> T: Bus=09 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
> D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
> P: Vendor=8087 ProdID=0040 Rev= 0.00
> C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
> I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
> E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
> E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
>
> [...]
Here is the summary with links:
- [v3] Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
https://git.kernel.org/bluetooth/bluetooth-next/c/a9a4dd96b77c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1] Bluetooth: btusb: MT7925: Add VID/PID 13d3/3609 Add VID 13d3 & PID 3609 for MediaTek MT7925 USB Bluetooth chip.
From: patchwork-bot+bluetooth @ 2026-05-13 17:30 UTC (permalink / raw)
To: Luke-yj Chen
Cc: marcel, johan.hedberg, luiz.dentz, sean.wang, chris.lu,
will-cy.lee, ss.wu, steve.lee, linux-bluetooth, linux-kernel,
linux-mediatek
In-Reply-To: <20260512033422.3242781-1-luke-yj.chen@mediatek.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 12 May 2026 11:34:21 +0800 you wrote:
> From: "luke-yj.chen" <luke-yj.chen@mediatek.com>
>
> The information in /sys/kernel/debug/usb/devices about the Bluetooth
> device is listed as the below.
>
> T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
> D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
> P: Vendor=13d3 ProdID=3609 Rev= 1.00
> S: Manufacturer=MediaTek Inc.
> S: Product=Wireless_Device
> S: SerialNumber=000000000
> C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
> A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
> I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
> E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
> E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
> I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
> I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
> E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
> I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
> E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
>
> [...]
Here is the summary with links:
- [v1] Bluetooth: btusb: MT7925: Add VID/PID 13d3/3609 Add VID 13d3 & PID 3609 for MediaTek MT7925 USB Bluetooth chip.
https://git.kernel.org/bluetooth/bluetooth-next/c/ae3ff17c6240
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2] Bluetooth: btusb: MT7925: Add VID/PID 13d3/3609
From: patchwork-bot+bluetooth @ 2026-05-13 17:30 UTC (permalink / raw)
To: Luke-yj Chen
Cc: marcel, johan.hedberg, luiz.dentz, sean.wang, chris.lu,
will-cy.lee, ss.wu, steve.lee, linux-bluetooth, linux-kernel,
linux-mediatek
In-Reply-To: <20260512060318.3288273-1-luke-yj.chen@mediatek.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 12 May 2026 14:03:18 +0800 you wrote:
> From: "luke-yj.chen" <luke-yj.chen@mediatek.com>
>
> Add VID 13d3 & PID 3609 for MediaTek MT7925 USB Bluetooth chip.
>
> The information in /sys/kernel/debug/usb/devices about the Bluetooth
> device is listed as the below.
>
> [...]
Here is the summary with links:
- [v2] Bluetooth: btusb: MT7925: Add VID/PID 13d3/3609
https://git.kernel.org/bluetooth/bluetooth-next/c/ae3ff17c6240
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH v2] Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
From: Luiz Augusto von Dentz @ 2026-05-13 17:32 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and in
fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected using
l2cap_send_disconn_req otherwise the remote peer would have no idea that
it shall consider to be disconnected.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/l2cap_core.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fdccd62ccca8..4c68ee5cec7e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5242,7 +5242,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
struct l2cap_ecred_conn_rsp *rsp = (void *) data;
struct hci_conn *hcon = conn->hcon;
u16 mtu, mps, credits, result;
- struct l2cap_chan *chan, *tmp;
+ struct l2cap_chan *chan, *tmp, *orig = NULL;
int err = 0, sec_level;
int i = 0;
@@ -5262,7 +5262,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
u16 dcid;
- if (chan->ident != cmd->ident ||
+ if (orig == chan || chan->ident != cmd->ident ||
chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
chan->state == BT_CONNECTED)
continue;
@@ -5281,8 +5281,10 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
+ orig = __l2cap_get_chan_by_dcid(conn, dcid);
+
/* Check if dcid is already in use */
- if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
+ if (dcid && orig) {
/* If a device receives a
* L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
* already-assigned Destination CID, then both the
@@ -5291,10 +5293,13 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
*/
l2cap_chan_del(chan, ECONNREFUSED);
l2cap_chan_unlock(chan);
- chan = __l2cap_get_chan_by_dcid(conn, dcid);
- l2cap_chan_lock(chan);
- l2cap_chan_del(chan, ECONNRESET);
- l2cap_chan_unlock(chan);
+ l2cap_chan_lock(orig);
+ /* Disconnect the original channel as it may be
+ * considered connected since dcid has already been
+ * assigned.
+ */
+ l2cap_chan_close(orig, ECONNRESET);
+ l2cap_chan_unlock(orig);
continue;
}
--
2.53.0
^ permalink raw reply related
* RE: [v2] Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
From: bluez.test.bot @ 2026-05-13 18:15 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260513173228.1220717-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 937 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094370
---Test result---
Test Summary:
CheckPatch PASS 0.54 seconds
GitLint PASS 0.21 seconds
SubjectPrefix PASS 0.06 seconds
BuildKernel PASS 26.73 seconds
CheckAllWarning PASS 28.99 seconds
CheckSparse PASS 27.94 seconds
BuildKernel32 PASS 25.65 seconds
TestRunnerSetup PASS 573.39 seconds
TestRunner_l2cap-tester PASS 376.55 seconds
IncrementalBuild PASS 25.42 seconds
https://github.com/bluez/bluetooth-next/pull/184
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: shared/bap: set QoS state when CIS is lost
From: bluez.test.bot @ 2026-05-13 18:22 UTC (permalink / raw)
To: linux-bluetooth, raghavendra.rao
In-Reply-To: <20260513163435.11344-2-raghavendra.rao@collabora.com>
[-- Attachment #1: Type: text/plain, Size: 2549 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094333
---Test result---
Test Summary:
CheckPatch FAIL 0.39 seconds
GitLint PASS 0.28 seconds
BuildEll PASS 20.27 seconds
BluezMake PASS 610.55 seconds
MakeCheck PASS 12.68 seconds
MakeDistcheck PASS 234.89 seconds
CheckValgrind PASS 254.42 seconds
CheckSmatch WARNING 321.72 seconds
bluezmakeextell PASS 164.59 seconds
IncrementalBuild PASS 609.76 seconds
ScanBuild PASS 913.46 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v2,1/1] shared/bap: set QoS state when CIS is lost
WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#74:
This is used to pass PTS tests BAP/USR/SCC/BV-167-C and BAP/USR/SCC/BV-168-C.
/github/workspace/src/patch/14571723.patch total: 0 errors, 1 warnings, 10 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14571723.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:312:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
https://github.com/bluez/bluez/pull/2124
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Functional/integration testing
From: bluez.test.bot @ 2026-05-13 18:23 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <685f40f012bc71f7313e2dc19a21d6597d29cf91.1778688966.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 4544 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094320
---Test result---
Test Summary:
CheckPatch FAIL 6.03 seconds
GitLint FAIL 4.35 seconds
BuildEll PASS 20.01 seconds
BluezMake PASS 608.25 seconds
MakeCheck PASS 19.22 seconds
MakeDistcheck PASS 232.69 seconds
CheckValgrind PASS 272.79 seconds
CheckSmatch WARNING 322.12 seconds
bluezmakeextell PASS 165.37 seconds
IncrementalBuild PASS 658.64 seconds
ScanBuild PASS 916.62 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v5,12/16] test: add functional/integration testing framework
ERROR:EXECUTE_PERMISSIONS: do not set execute permissions for source files
#422: FILE: test/test-functional
ERROR:EXECUTE_PERMISSIONS: do not set execute permissions for source files
#449: FILE: test/test-functional-attach
/github/workspace/src/patch/14571682.patch total: 2 errors, 0 warnings, 279 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14571682.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v5,01/16] emulator: btvirt: check pkt lengths, don't get stuck on malformed
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[BlueZ,v5,01/16] emulator: btvirt: check pkt lengths, don't get stuck on malformed"
[BlueZ,v5,02/16] emulator: btvirt: allow specifying where server unix sockets are made
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (86>80): "[BlueZ,v5,02/16] emulator: btvirt: allow specifying where server unix sockets are made"
[BlueZ,v5,08/16] test-runner: use virtio-serial for implementing -u device forwarding
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (85>80): "[BlueZ,v5,08/16] test-runner: use virtio-serial for implementing -u device forwarding"
[BlueZ,v5,10/16] doc: enable KVM paravirtualization & clock support in tester kernel config
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (91>80): "[BlueZ,v5,10/16] doc: enable KVM paravirtualization & clock support in tester kernel config"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/btdev.c:478:29: warning: Variable length array is used.
https://github.com/bluez/bluez/pull/2123
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH] Bluetooth: hci_core: Don't queue tx_work while draining workqueue
From: Heitor Alves de Siqueira @ 2026-05-13 18:55 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, Gustavo Padovan
Cc: linux-bluetooth, linux-kernel, kernel-dev,
syzbot+97721dd81f792e838ba0
Syzbot reported a warning when L2CAP calls queue_work() on the hdev
workqueue while it's being drained. This can happen during device reset or
close paths for hci_send_acl(), hci_send_sco() and hci_send_iso().
The workqueue is drained in hci_dev_do_reset() and in hci_dev_close_sync():
- hci_dev_close_sync() clears the HCI_UP bit before draining
- hci_dev_do_reset() sets HCI_CMD_DRAIN_WORKQUEUE before draining
Add these checks before queuing tx_work, and free the SKB if it's not
queued for transmission.
Fixes: 3eff45eaf817 ("Bluetooth: convert tx_task to workqueue")
Reported-by: syzbot+97721dd81f792e838ba0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=97721dd81f792e838ba0
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
---
net/bluetooth/hci_core.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c46c1236ebfa..5d5f8ad7d1a8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3278,6 +3278,12 @@ void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
+ if (!test_bit(HCI_UP, &hdev->flags) ||
+ hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) {
+ kfree_skb(skb);
+ return;
+ }
+
hci_queue_acl(chan, &chan->data_q, skb, flags);
queue_work(hdev->workqueue, &hdev->tx_work);
@@ -3291,6 +3297,12 @@ void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
BT_DBG("%s len %d", hdev->name, skb->len);
+ if (!test_bit(HCI_UP, &hdev->flags) ||
+ hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) {
+ kfree_skb(skb);
+ return;
+ }
+
hdr.handle = cpu_to_le16(conn->handle);
hdr.dlen = skb->len;
@@ -3374,6 +3386,12 @@ void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
BT_DBG("%s len %d", hdev->name, skb->len);
+ if (!test_bit(HCI_UP, &hdev->flags) ||
+ hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) {
+ kfree_skb(skb);
+ return;
+ }
+
hci_queue_iso(conn, &conn->data_q, skb);
queue_work(hdev->workqueue, &hdev->tx_work);
---
base-commit: 1f63dd8ca0dc05a8272bb8155f643c691d29bb11
change-id: 20260513-hci_send-640290de7acc
Best regards,
--
Heitor Alves de Siqueira <halves@igalia.com>
^ permalink raw reply related
* [PATCH v2] Bluetooth: btusb: clear remote wake on idle Intel ACPI paths
From: Sean Rhodes @ 2026-05-13 19:35 UTC (permalink / raw)
To: linux-kernel
Cc: Marcel Holtmann, Luiz Augusto von Dentz, linux-bluetooth,
Paul Menzel
Commit 8020c41b39f5 ("usb: core: allow ACPI-managed hard-wired ports
to power off") allows internal USB devices on ACPI-managed hard-wired
ports to use the existing runtime power-off path. For Intel combined USB
Bluetooth controllers, btusb still keeps runtime remote wake enabled for
as long as the adapter is open, which prevents the USB PM core from
dropping the last child reference and powering the port off while idle.
Only keep runtime remote wake enabled while the controller is expected
to signal activity on its own: established links, discovery, LE scan,
LE advertising, or BR/EDR page/inquiry scan. When those are idle, clear
needs_remote_wakeup so autosuspend can power-manage the port and a later
host-initiated command can resume the device again.
Cache the BTUSB_INTEL_COMBINED match flag in btusb_data so the runtime
wake decision can be made from the open and receive paths, where the
usb_device_id used during probe is no longer available.
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
---
drivers/bluetooth/btusb.c | 50 +++++++++++++++++++++++++++++++++++++--
1 file changed, 48 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7f5fce93d984..8e30c968fd6a 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -950,6 +950,7 @@ struct btusb_data {
unsigned long flags;
bool poll_sync;
+ bool intel_combined;
int intr_interval;
struct work_struct work;
struct work_struct waker;
@@ -1007,6 +1008,9 @@ struct btusb_data {
struct qca_dump_info qca_dump;
};
+static bool btusb_intel_idle_power_manageable(struct btusb_data *data);
+static bool btusb_needs_runtime_remote_wakeup(struct btusb_data *data);
+
static void btusb_reset(struct hci_dev *hdev)
{
struct btusb_data *data;
@@ -1218,12 +1222,19 @@ static inline void btusb_free_frags(struct btusb_data *data)
static int btusb_recv_event(struct btusb_data *data, struct sk_buff *skb)
{
+ int err;
+
if (data->intr_interval) {
/* Trigger dequeue immediately if an event is received */
schedule_delayed_work(&data->rx_work, 0);
}
- return data->recv_event(data->hdev, skb);
+ err = data->recv_event(data->hdev, skb);
+ if (!err)
+ data->intf->needs_remote_wakeup =
+ btusb_needs_runtime_remote_wakeup(data);
+
+ return err;
}
static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
@@ -1991,7 +2002,8 @@ static int btusb_open(struct hci_dev *hdev)
goto setup_fail;
}
- data->intf->needs_remote_wakeup = 1;
+ data->intf->needs_remote_wakeup =
+ btusb_needs_runtime_remote_wakeup(data);
if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
goto done;
@@ -2034,6 +2046,38 @@ static void btusb_stop_traffic(struct btusb_data *data)
usb_kill_anchored_urbs(&data->ctrl_anchor);
}
+static bool btusb_intel_idle_power_manageable(struct btusb_data *data)
+{
+ struct usb_device *udev = data->udev;
+
+ return data->intel_combined && udev->parent &&
+ usb_acpi_power_manageable(udev->parent, udev->portnum - 1);
+}
+
+static bool btusb_needs_runtime_remote_wakeup(struct btusb_data *data)
+{
+ struct hci_dev *hdev = data->hdev;
+
+ if (!btusb_intel_idle_power_manageable(data))
+ return true;
+
+ if (hci_conn_count(hdev))
+ return true;
+
+ if (hdev->discovery.state == DISCOVERY_FINDING ||
+ hdev->discovery.state == DISCOVERY_RESOLVING)
+ return true;
+
+ if (hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
+ hci_dev_test_flag(hdev, HCI_LE_ADV) ||
+ hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+ test_bit(HCI_PSCAN, &hdev->flags) ||
+ test_bit(HCI_ISCAN, &hdev->flags))
+ return true;
+
+ return false;
+}
+
static int btusb_close(struct hci_dev *hdev)
{
struct btusb_data *data = hci_get_drvdata(hdev);
@@ -4118,6 +4162,8 @@ static int btusb_probe(struct usb_interface *intf,
data->recv_bulk = btusb_recv_bulk;
if (id->driver_info & BTUSB_INTEL_COMBINED) {
+ data->intel_combined = true;
+
/* Allocate extra space for Intel device */
priv_size += sizeof(struct btintel_data);
^ permalink raw reply related
* [PATCH] Bluetooth: btusb: always reload QCA firmware regardless of chip-reported statu
From: makro-kernel @ 2026-05-13 20:01 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
Cc: marcel@holtmann.org, luiz.dentz@gmail.com,
linux-kernel@vger.kernel.org
btusb_setup_qca() currently skips rampatch and NVM downloads when the
chip reports QCA_PATCH_UPDATED and QCA_SYSCFG_UPDATED bits set in its
status byte. The intent is to avoid redundant firmware uploads when the
chip is already in the expected state.
However, some QCA chips (notably the WCN785x family, rebadged by Foxconn
as USB 0489:e10a in MSI X870/B850 motherboards) retain firmware state
across reboots in on-die NVM. When a previous OS (e.g. Windows) or an
older driver has loaded a different firmware build, the chip happily
reports PATCH_UPDATED|SYSCFG_UPDATED to QCA_CHECK_STATUS, and btusb
trusts it -- leaving the chip running stale or incompatible firmware.
The user-visible symptom is severe: pairing works, BR/EDR connections
work, AVDTP signaling completes (Discover/GetCaps/SetConfig/Open all
succeed), but the subsequent AVDTP Acquire fails with
org.bluez.Error.Failed and A2DP audio cannot stream. The chip also
emits at startup:
Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command
is advertised, but not supported.
which is a hint that the running firmware is not the rampatch-fixed
version btusb assumes.
Diagnosed on Foxconn 0489:e10a (Qualcomm WCN785x 2.0, ROM 0x00190200)
against a Bose QC Ultra 2 HP headset on an MSI MAG X870E TOMAHAWK WIFI
board: QCA_CHECK_STATUS returned 0xe0 on every probe (after a Windows
install had been wiped), and both firmware loads were skipped, leaving
the chip on Windows-era firmware build 0x8567 instead of Linux's
expected build 0x6254. With the guard removed, btusb downloads the
correct rampatch and NVM, and audio works end-to-end.
The redundant upload on a "truly already-patched" chip costs only a few
hundred milliseconds during enumeration and is the same cost paid by
the equivalent Windows driver path, which is known to always re-flash
firmware on every boot regardless of chip status.
Reported-by: Makro <makro-kernel@proton.me>
Signed-off-by: Makro <makro-kernel@proton.me>
---
drivers/bluetooth/btusb.c | 45 ++++++++++++++++++++++-----------------
1 file changed, 25 insertions(+), 20 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3afbad667..65c4f0fec 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3646,7 +3646,6 @@ static int btusb_setup_qca(struct hci_dev *hdev)
const struct qca_device_info *info = NULL;
struct qca_version ver;
u32 ver_rom;
- u8 status;
int i, err;
err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
@@ -3672,17 +3671,25 @@ static int btusb_setup_qca(struct hci_dev *hdev)
return -ENODEV;
}
- err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
- sizeof(status));
+ /*
+ * Some QCA chips (notably WCN785x family rebadged by Foxconn as
+ * USB 0489:e10a in MSI X870/B850 motherboards) retain firmware
+ * state across reboots in on-die NVM. After a previous OS or
+ * driver version has loaded firmware, QCA_CHECK_STATUS reports
+ * PATCH_UPDATED|SYSCFG_UPDATED even though the running firmware
+ * may be incompatible with what bluez/btusb expect. Trusting the
+ * status flags then leaves the chip on stale firmware, breaking
+ * AVDTP transport setup (Acquire returns Failed; A2DP audio
+ * cannot stream).
+ *
+ * Always re-apply the rampatch and NVM to guarantee a known-good
+ * firmware state on every probe. The cost is a few hundred
+ * milliseconds of firmware upload during enumeration.
+ */
+ err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
if (err < 0)
return err;
- if (!(status & QCA_PATCH_UPDATED)) {
- err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
- if (err < 0)
- return err;
- }
-
err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
sizeof(ver));
if (err < 0)
@@ -3691,18 +3698,16 @@ static int btusb_setup_qca(struct hci_dev *hdev)
btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
- if (!(status & QCA_SYSCFG_UPDATED)) {
- err = btusb_setup_qca_load_nvm(hdev, &ver, info);
- if (err < 0)
- return err;
+ err = btusb_setup_qca_load_nvm(hdev, &ver, info);
+ if (err < 0)
+ return err;
- /* WCN6855 2.1 and later will reset to apply firmware downloaded here, so
- * wait ~100ms for reset Done then go ahead, otherwise, it maybe
- * cause potential enable failure.
- */
- if (info->rom_version >= 0x00130201)
- msleep(QCA_BT_RESET_WAIT_MS);
- }
+ /* WCN6855 2.1 and later will reset to apply firmware downloaded here, so
+ * wait ~100ms for reset Done then go ahead, otherwise, it maybe
+ * cause potential enable failure.
+ */
+ if (info->rom_version >= 0x00130201)
+ msleep(QCA_BT_RESET_WAIT_MS);
/* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to
* work with the likes of HSP/HFP mSBC.
--
2.54.0
^ permalink raw reply related
* [Bug 221511] MT7925 7.1 rc does not work, but it works in kernel 7.0
From: bugzilla-daemon @ 2026-05-13 20:03 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-221511-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=221511
--- Comment #1 from erpumper@gmail.com ---
Created attachment 310115
--> https://bugzilla.kernel.org/attachment.cgi?id=310115&action=edit
MT7925 7.1 rc does not work, but it works in kernel 7.0
MT7925 7.1 rc does not work, but it works in kernel 7.0
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* RE: Bluetooth: hci_core: Don't queue tx_work while draining workqueue
From: bluez.test.bot @ 2026-05-13 20:45 UTC (permalink / raw)
To: linux-bluetooth, halves
In-Reply-To: <20260513-hci_send-v1-1-ae3eef758280@igalia.com>
[-- Attachment #1: Type: text/plain, Size: 2039 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094429
---Test result---
Test Summary:
CheckPatch PASS 0.74 seconds
GitLint FAIL 0.34 seconds
SubjectPrefix PASS 0.22 seconds
BuildKernel PASS 25.24 seconds
CheckAllWarning PASS 27.80 seconds
CheckSparse PASS 26.72 seconds
BuildKernel32 PASS 24.56 seconds
TestRunnerSetup PASS 528.86 seconds
TestRunner_l2cap-tester PASS 374.94 seconds
TestRunner_iso-tester PASS 604.66 seconds
TestRunner_bnep-tester PASS 19.00 seconds
TestRunner_mgmt-tester PASS 2024.13 seconds
TestRunner_rfcomm-tester PASS 63.77 seconds
TestRunner_sco-tester PASS 141.62 seconds
TestRunner_ioctl-tester PASS 134.21 seconds
TestRunner_mesh-tester PASS 59.93 seconds
TestRunner_smp-tester PASS 18.06 seconds
TestRunner_userchan-tester PASS 19.33 seconds
TestRunner_6lowpan-tester PASS 51.00 seconds
IncrementalBuild PASS 24.65 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: hci_core: Don't queue tx_work while draining workqueue
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
27: B2 Line has trailing whitespace: "-- "
https://github.com/bluez/bluetooth-next/pull/185
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Bluetooth: btusb: always reload QCA firmware regardless of chip-reported statu
From: bluez.test.bot @ 2026-05-13 21:01 UTC (permalink / raw)
To: linux-bluetooth, makro-kernel
In-Reply-To: <aD_Lix2EVXOHmbZ4L1CunlWiLqfiKlU_1_FcVh4CBuIgud4kmE_544xjW2zFKsmh4pNAo9yIQ7q8_GZ4YcmgAXPp8LgW9rfWKqnu06WSjgk=@proton.me>
[-- Attachment #1: Type: text/plain, Size: 553 bytes --]
This is an automated email and please do not reply to this email.
Dear Submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.
----- Output -----
error: patch failed: drivers/bluetooth/btusb.c:3646
error: drivers/bluetooth/btusb.c: patch does not apply
hint: Use 'git am --show-current-patch' to see the failed patch
Please resolve the issue and submit the patches again.
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [v2] Bluetooth: btusb: clear remote wake on idle Intel ACPI paths
From: bluez.test.bot @ 2026-05-13 21:26 UTC (permalink / raw)
To: linux-bluetooth, sean
In-Reply-To: <19a2b7d308f5cdfa651fee727c1423833380ea1b.1778700929.git.sean@starlabs.systems>
[-- Attachment #1: Type: text/plain, Size: 882 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1094450
---Test result---
Test Summary:
CheckPatch PASS 0.78 seconds
GitLint PASS 0.34 seconds
SubjectPrefix PASS 0.13 seconds
BuildKernel PASS 26.45 seconds
CheckAllWarning PASS 29.11 seconds
CheckSparse PASS 27.53 seconds
BuildKernel32 PASS 25.45 seconds
TestRunnerSetup PASS 564.10 seconds
IncrementalBuild PASS 24.76 seconds
https://github.com/bluez/bluetooth-next/pull/186
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH v2 1/8] dt-bindings: mmc: Document support for nvmem-layout
From: Rob Herring @ 2026-05-13 22:42 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Krzysztof Kozlowski, Conor Dooley, Bjorn Andersson,
Konrad Dybcio, Jens Axboe, Johannes Berg, Jeff Johnson,
Bartosz Golaszewski, Marcel Holtmann, Luiz Augusto von Dentz,
Balakrishna Godavarthi, Rocky Liao, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Srinivas Kandagatla,
Andrew Lunn, Heiner Kallweit, Russell King, Saravana Kannan,
linux-mmc, devicetree, linux-kernel, linux-arm-msm, linux-block,
linux-wireless, ath10k, linux-bluetooth, netdev, daniel
In-Reply-To: <20260507-block-as-nvmem-v2-1-bf17edd5134e@oss.qualcomm.com>
On Thu, May 07, 2026 at 05:24:36PM +0200, Loic Poulain wrote:
> Add support for an nvmem-layout subnode under an eMMC hardware
> partition. This allows the partition to be exposed as an NVMEM
> provider and its internal layout to be described. For example,
> an eMMC boot partition can be used to store device-specific
> information such as a WiFi MAC address.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
> .../devicetree/bindings/mmc/mmc-card.yaml | 24 ++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/mmc/mmc-card.yaml b/Documentation/devicetree/bindings/mmc/mmc-card.yaml
> index a61d6c96df759102f9c1fbfd548b026a77921cae..b21426a49cf1d9aae5b4e8e447b5be11b08c96bf 100644
> --- a/Documentation/devicetree/bindings/mmc/mmc-card.yaml
> +++ b/Documentation/devicetree/bindings/mmc/mmc-card.yaml
> @@ -40,6 +40,9 @@ patternProperties:
> contains:
> const: fixed-partitions
>
> + nvmem-layout:
> + $ref: /schemas/nvmem/layouts/nvmem-layout.yaml
> +
> required:
> - compatible
> - reg
> @@ -86,6 +89,27 @@ examples:
> read-only;
> };
> };
> +
> + partitions-boot2 {
Shouldn't this have a 'fixed-partitions' compatible? I'm not sure if
it's an oversight in the schema that 'compatible' is not required here.
It would be odd that compatible is optional, but if it is present, it
must contain 'fixed-partitions' compatible. A follow-up to fix that
would be great.
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Rob
^ permalink raw reply
* Re: [PATCH] Bluetooth: hci_core: Don't queue tx_work while draining workqueue
From: Hillf Danton @ 2026-05-14 2:04 UTC (permalink / raw)
To: Heitor Alves de Siqueira
Cc: Marcel Holtmann, Luiz Augusto von Dentz, Gustavo Padovan,
linux-bluetooth, linux-kernel, kernel-dev, syzkaller-bugs,
syzbot+97721dd81f792e838ba0
In-Reply-To: <20260513-hci_send-v1-1-ae3eef758280@igalia.com>
On Wed, 13 May 2026 15:55:23 -0300 Heitor Alves de Siqueira wrote:
> Syzbot reported a warning when L2CAP calls queue_work() on the hdev
> workqueue while it's being drained. This can happen during device reset or
> close paths for hci_send_acl(), hci_send_sco() and hci_send_iso().
>
> The workqueue is drained in hci_dev_do_reset() and in hci_dev_close_sync():
> - hci_dev_close_sync() clears the HCI_UP bit before draining
> - hci_dev_do_reset() sets HCI_CMD_DRAIN_WORKQUEUE before draining
>
> Add these checks before queuing tx_work, and free the SKB if it's not
> queued for transmission.
>
> Fixes: 3eff45eaf817 ("Bluetooth: convert tx_task to workqueue")
> Reported-by: syzbot+97721dd81f792e838ba0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=97721dd81f792e838ba0
> Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
> ---
> net/bluetooth/hci_core.c | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index c46c1236ebfa..5d5f8ad7d1a8 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3278,6 +3278,12 @@ void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
>
> BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
>
> + if (!test_bit(HCI_UP, &hdev->flags) ||
> + hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) {
> + kfree_skb(skb);
> + return;
> + }
> +
> hci_queue_acl(chan, &chan->data_q, skb, flags);
>
> queue_work(hdev->workqueue, &hdev->tx_work);
>
What you add is not enough, go and see how HCI_CMD_DRAIN_WORKQUEUE is
checked in hci_cmd_work(), and in hci_dev_do_reset() for why.
^ permalink raw reply
* Re: [PATCH v2] Bluetooth: btusb: Allow firmware re-download when version matches
From: makro-kernel @ 2026-05-14 2:44 UTC (permalink / raw)
To: shuai.zhang@oss.qualcomm.com
Cc: luiz.dentz@gmail.com, marcel@holtmann.org,
linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-msm@vger.kernel.org
Hi Shuai, Luiz,
I sent a patch earlier today touching the same function for a related
but distinct failure mode in the same family of chips, and only just
saw this thread.
https://lore.kernel.org/linux-bluetooth/aD_Lix2EVXOHmbZ4L1CunlWiLqfiKlU_1_FcVh4CBuIgud4kmE_544xjW2zFKsmh4pNAo9yIQ7q8_GZ4YcmgAXPp8LgW9rfWKqnu06WSjgk=@proton.me/T/#u
In my case the *outer* check fails first: on Foxconn USB 0489:e10a
(Qualcomm WCN6855/WCN785x, ROM 0x00190200) the chip reports
QCA_CHECK_STATUS = 0xe0 (PATCH_UPDATED | SYSCFG_UPDATED) on every
probe, so btusb_setup_qca() never reaches load_rampatch() or
load_nvm(), returns 0, and the controller runs unpatched firmware.
AVDTP setup later fails on Acquire and A2DP audio cannot stream. The
PATCH_UPDATED bit appears to persist across cold boots somewhere on
chip -- originally set by Windows on dual-boot-then-Linux systems
we've seen, but the bit sticks even after a successful Linux firmware
upload, so subsequent boots also see 0xe0 and skip.
The rampatch itself also persists on this silicon at least across
suspend/hibernate resume cycles and driver reload (whether it
survives a true cold boot I haven't isolated). Either way, once an
upload has succeeded the chip reports patch_version equal to the
file's version on subsequent probes, which is exactly the condition
your patch addresses. With my outer bypass in place but without your
inner change, the second and subsequent probes hit the existing
`rver_patch <= ver_patch` check, return -EINVAL, and controller
setup aborts entirely:
Bluetooth: hci0: using rampatch file: qca/rampatch_usb_00190200.bin
Bluetooth: hci0: QCA: patch rome 0x190200 build 0x8567, firmware rome 0x190200 build 0x8567
Bluetooth: hci0: rampatch file version did not match with firmware
(btusb_setup_qca returns -EINVAL, hci0 never finishes registering)
So your fix is doing the right thing here, and on this hardware both
sides are needed together for the chip to come up cleanly across
reload / reboot cycles.
In my local tree I skip reuploading on equal versions rather than
re-uploading on every probe:
if (rver_rom != ver_rom) {
bt_dev_err(hdev, "rampatch file ROM did not match controller");
err = -EINVAL;
goto done;
}
if (rver_patch <= ver_patch) {
bt_dev_info(hdev, "QCA: rampatch already current, skipping download");
err = 0;
goto done;
}
err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
Best,
Makro
^ permalink raw reply
* [PATCH] bluetooth: btnxpuart: Fix use-after-free in probe error path
From: Zhao Dongdong @ 2026-05-14 6:03 UTC (permalink / raw)
To: amitkumar.karwar, neeraj.sanjaykale, marcel
Cc: linux-bluetooth, Zhao Dongdong
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
In nxp_serdev_probe(), if hci_register_dev() succeeds but ps_setup()
fails, the error path jumps to 'probe_fail' which only calls
hci_free_dev() and asserts the reset GPIO, but does NOT call
hci_unregister_dev() first.
This leaves the HCI device registered in the system with its backing
memory freed, leading to a use-after-free when userspace subsequently
accesses the device (e.g. via hciconfig or bluetoothd).
Fix by adding a 'probe_fail_unregister' label that calls
hci_unregister_dev() before falling through to the existing
'probe_fail' label. The original 'probe_fail' label is preserved
for the case where hci_register_dev() itself fails (device was
never registered, so no unregister is needed).
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
drivers/bluetooth/btnxpuart.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index e7036a48ce48..a4d7747e5be0 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1907,13 +1907,15 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
}
if (ps_setup(hdev))
- goto probe_fail;
+ goto probe_fail_unregister;
hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
nxp_coredump_notify);
return 0;
+probe_fail_unregister:
+ hci_unregister_dev(hdev);
probe_fail:
reset_control_assert(nxpdev->pdn);
hci_free_dev(hdev);
--
2.25.1
^ permalink raw reply related
* [bluetooth-next:master] BUILD SUCCESS a9a4dd96b77c5999153a555c1e1ca0e95ec841ab
From: kernel test robot @ 2026-05-14 6:50 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
branch HEAD: a9a4dd96b77c5999153a555c1e1ca0e95ec841ab Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
elapsed time: 803m
configs tested: 252
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-23
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001 gcc-8.5.0
arc randconfig-001-20260514 clang-23
arc randconfig-001-20260514 gcc-8.5.0
arc randconfig-002 gcc-8.5.0
arc randconfig-002-20260514 clang-23
arc randconfig-002-20260514 gcc-8.5.0
arm allnoconfig clang-23
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm defconfig gcc-15.2.0
arm randconfig-001 gcc-8.5.0
arm randconfig-001-20260514 clang-23
arm randconfig-001-20260514 gcc-8.5.0
arm randconfig-002 gcc-8.5.0
arm randconfig-002-20260514 clang-23
arm randconfig-002-20260514 gcc-8.5.0
arm randconfig-003 gcc-8.5.0
arm randconfig-003-20260514 clang-23
arm randconfig-003-20260514 gcc-8.5.0
arm randconfig-004 gcc-8.5.0
arm randconfig-004-20260514 clang-23
arm randconfig-004-20260514 gcc-8.5.0
arm vf610m4_defconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260514 clang-23
arm64 randconfig-002-20260514 clang-23
arm64 randconfig-003-20260514 clang-23
arm64 randconfig-004-20260514 clang-23
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260514 clang-23
csky randconfig-002-20260514 clang-23
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001 gcc-11.5.0
hexagon randconfig-001-20260514 gcc-10.5.0
hexagon randconfig-002 gcc-11.5.0
hexagon randconfig-002-20260514 gcc-10.5.0
i386 allmodconfig clang-20
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001 gcc-14
i386 buildonly-randconfig-001-20260514 gcc-14
i386 buildonly-randconfig-002 gcc-14
i386 buildonly-randconfig-002-20260514 gcc-14
i386 buildonly-randconfig-003 gcc-14
i386 buildonly-randconfig-003-20260514 gcc-14
i386 buildonly-randconfig-004 gcc-14
i386 buildonly-randconfig-004-20260514 gcc-14
i386 buildonly-randconfig-005 gcc-14
i386 buildonly-randconfig-005-20260514 gcc-14
i386 buildonly-randconfig-006 gcc-14
i386 buildonly-randconfig-006-20260514 gcc-14
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260514 clang-20
i386 randconfig-002-20260514 clang-20
i386 randconfig-003-20260514 clang-20
i386 randconfig-004-20260514 clang-20
i386 randconfig-005-20260514 clang-20
i386 randconfig-006-20260514 clang-20
i386 randconfig-007-20260514 clang-20
i386 randconfig-011-20260514 clang-20
i386 randconfig-012-20260514 clang-20
i386 randconfig-013-20260514 clang-20
i386 randconfig-014-20260514 clang-20
i386 randconfig-015-20260514 clang-20
i386 randconfig-016-20260514 clang-20
i386 randconfig-017-20260514 clang-20
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-23
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001 gcc-11.5.0
loongarch randconfig-001-20260514 gcc-10.5.0
loongarch randconfig-002 gcc-11.5.0
loongarch randconfig-002-20260514 gcc-10.5.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k defconfig clang-19
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips maltasmvp_defconfig gcc-15.2.0
mips qi_lb60_defconfig clang-23
nios2 allmodconfig clang-23
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-19
nios2 randconfig-001 gcc-11.5.0
nios2 randconfig-001-20260514 gcc-10.5.0
nios2 randconfig-002 gcc-11.5.0
nios2 randconfig-002-20260514 gcc-10.5.0
openrisc allmodconfig clang-23
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001 gcc-13.4.0
parisc randconfig-001-20260514 gcc-13.4.0
parisc randconfig-002 gcc-13.4.0
parisc randconfig-002-20260514 gcc-13.4.0
parisc64 defconfig clang-19
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001 gcc-13.4.0
powerpc randconfig-001-20260514 gcc-13.4.0
powerpc randconfig-002 gcc-13.4.0
powerpc randconfig-002-20260514 gcc-13.4.0
powerpc tqm8541_defconfig clang-23
powerpc64 randconfig-001 gcc-13.4.0
powerpc64 randconfig-001-20260514 gcc-13.4.0
powerpc64 randconfig-002 gcc-13.4.0
powerpc64 randconfig-002-20260514 gcc-13.4.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260514 gcc-14.3.0
riscv randconfig-002-20260514 gcc-14.3.0
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260514 gcc-14.3.0
s390 randconfig-002-20260514 gcc-14.3.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-23
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh randconfig-001-20260514 gcc-14.3.0
sh randconfig-002-20260514 gcc-14.3.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001 gcc-15.2.0
sparc randconfig-001-20260514 gcc-15.2.0
sparc randconfig-002 gcc-15.2.0
sparc randconfig-002-20260514 gcc-15.2.0
sparc64 allmodconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001 gcc-15.2.0
sparc64 randconfig-001-20260514 gcc-15.2.0
sparc64 randconfig-002 gcc-15.2.0
sparc64 randconfig-002-20260514 gcc-15.2.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001 gcc-15.2.0
um randconfig-001-20260514 gcc-15.2.0
um randconfig-002 gcc-15.2.0
um randconfig-002-20260514 gcc-15.2.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-23
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001 clang-20
x86_64 buildonly-randconfig-001-20260514 clang-20
x86_64 buildonly-randconfig-002 clang-20
x86_64 buildonly-randconfig-002-20260514 clang-20
x86_64 buildonly-randconfig-003 clang-20
x86_64 buildonly-randconfig-003-20260514 clang-20
x86_64 buildonly-randconfig-004 clang-20
x86_64 buildonly-randconfig-004-20260514 clang-20
x86_64 buildonly-randconfig-005 clang-20
x86_64 buildonly-randconfig-005-20260514 clang-20
x86_64 buildonly-randconfig-006 clang-20
x86_64 buildonly-randconfig-006-20260514 clang-20
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001 gcc-14
x86_64 randconfig-001-20260514 gcc-14
x86_64 randconfig-002 gcc-14
x86_64 randconfig-002-20260514 gcc-14
x86_64 randconfig-003 gcc-14
x86_64 randconfig-003-20260514 gcc-14
x86_64 randconfig-004 gcc-14
x86_64 randconfig-004-20260514 gcc-14
x86_64 randconfig-005 gcc-14
x86_64 randconfig-005-20260514 gcc-14
x86_64 randconfig-006 gcc-14
x86_64 randconfig-006-20260514 gcc-14
x86_64 randconfig-011-20260514 clang-20
x86_64 randconfig-012-20260514 clang-20
x86_64 randconfig-013-20260514 clang-20
x86_64 randconfig-014-20260514 clang-20
x86_64 randconfig-015-20260514 clang-20
x86_64 randconfig-016-20260514 clang-20
x86_64 randconfig-071-20260514 clang-20
x86_64 randconfig-072-20260514 clang-20
x86_64 randconfig-072-20260514 gcc-14
x86_64 randconfig-073-20260514 clang-20
x86_64 randconfig-074-20260514 clang-20
x86_64 randconfig-074-20260514 gcc-14
x86_64 randconfig-075-20260514 clang-20
x86_64 randconfig-076-20260514 clang-20
x86_64 randconfig-076-20260514 gcc-13
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-23
xtensa allyesconfig gcc-15.2.0
xtensa randconfig-001 gcc-15.2.0
xtensa randconfig-001-20260514 gcc-15.2.0
xtensa randconfig-002 gcc-15.2.0
xtensa randconfig-002-20260514 gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox