* Re: [PATCH v2 2/7] wifi: ath11k: enable support for WCN6851
From: Dmitry Baryshkov @ 2026-06-11 20:05 UTC (permalink / raw)
To: Manivannan Sadhasivam, Lorenzo Pieralisi,
Krzysztof Wilczyński, Rob Herring, Bjorn Helgaas,
Konrad Dybcio, Qiang Yu, Jeff Johnson, Liam Girdwood, Mark Brown,
Krzysztof Kozlowski, Conor Dooley, Bartosz Golaszewski,
Marcel Holtmann, Luiz Augusto von Dentz, Balakrishna Godavarthi,
Rocky Liao, Bjorn Andersson, Konrad Dybcio
Cc: linux-arm-msm, linux-pci, linux-kernel, linux-wireless, ath11k,
devicetree, Bartosz Golaszewski, linux-bluetooth,
Bartosz Golaszewski
In-Reply-To: <20260608-sm8350-wifi-v2-2-efb68f1ff04c@oss.qualcomm.com>
On Mon, Jun 08, 2026 at 09:59:20AM +0300, Dmitry Baryshkov wrote:
> The WCN6851, found e.g. on SM8350 platforms, is an earlier version of
> WCN6855 platform. It identifies itself as hw1.1. Copy WCN6855 hw 2.0
> configuration to support hw1.1 version.
>
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> ---
> drivers/net/wireless/ath/ath11k/core.c | 92 ++++++++++++++++++++++++++++++++++
> drivers/net/wireless/ath/ath11k/core.h | 1 +
> drivers/net/wireless/ath/ath11k/mhi.c | 1 +
> drivers/net/wireless/ath/ath11k/pci.c | 9 ++++
> drivers/net/wireless/ath/ath11k/pcic.c | 11 ++++
> 5 files changed, 114 insertions(+)
This crashes with the firmware that came with the board,
WLAN.HSP.1.1.c3-00200-QCAHSPSWPL_V1_V2_SILICONZ. I will revert to 3
vdevs for v3.
--
With best wishes
Dmitry
^ permalink raw reply
* Re: [PATCH 2/7] wifi: ath11k: enable support for WCN6851
From: Dmitry Baryshkov @ 2026-06-11 20:03 UTC (permalink / raw)
To: Jeff Johnson
Cc: Manivannan Sadhasivam, Lorenzo Pieralisi,
Krzysztof Wilczyński, Rob Herring, Bjorn Helgaas,
Konrad Dybcio, Qiang Yu, Jeff Johnson, Liam Girdwood, Mark Brown,
Krzysztof Kozlowski, Conor Dooley, Bartosz Golaszewski,
Marcel Holtmann, Luiz Augusto von Dentz, Balakrishna Godavarthi,
Rocky Liao, Bjorn Andersson, Konrad Dybcio, linux-arm-msm,
linux-pci, linux-kernel, linux-wireless, ath11k, devicetree,
Bartosz Golaszewski, linux-bluetooth
In-Reply-To: <e5b487ea-151f-4d22-b046-b72447c023cf@oss.qualcomm.com>
On Mon, Jun 01, 2026 at 06:54:35AM -0700, Jeff Johnson wrote:
> On 6/1/2026 2:46 AM, Dmitry Baryshkov wrote:
> > The WCN6851, found e.g. on SM8350 platforms, is an earlier version of
> > WCN6855 platform. It identifies itself as hw1.1. Copy WCN6855 hw 2.0
> > configuration to support hw1.1 version.
> >
> > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> > ---
> > drivers/net/wireless/ath/ath11k/core.c | 92 ++++++++++++++++++++++++++++++++++
> > drivers/net/wireless/ath/ath11k/core.h | 1 +
> > drivers/net/wireless/ath/ath11k/mhi.c | 1 +
> > drivers/net/wireless/ath/ath11k/pci.c | 9 ++++
> > drivers/net/wireless/ath/ath11k/pcic.c | 11 ++++
> > 5 files changed, 114 insertions(+)
> >
> > diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
> > index 3f6f4db5b7ee..7e997016cf6e 100644
> > --- a/drivers/net/wireless/ath/ath11k/core.c
> > +++ b/drivers/net/wireless/ath/ath11k/core.c
> > @@ -393,6 +393,98 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
> > .cfr_num_stream_bufs = 0,
> > .cfr_stream_buf_size = 0,
> > },
> > + {
> > + .name = "wcn6855 hw1.1",
> > + .hw_rev = ATH11K_HW_WCN6855_HW11,
> > + .fw = {
> > + .dir = "WCN6855/hw1.1",
> > + .board_size = 256 * 1024,
> > + .cal_offset = 128 * 1024,
> > + },
> ...> + .num_vdevs = 2 + 1,
>
> this value is being modified to 4 in:
> https://msgid.link/20260525020711.2590815-1-wei.zhang@oss.qualcomm.com
>
> It is merging into ath-next today and should reach linux-next very soon.
I've upgraded it 4 for v2, but it crashes the original firmware that
came with the board. I'll revert it for 3 for the next iteration.
For the reference:
ath11k_pci 0000:01:00.0: BAR 0 [mem 0x60400000-0x605fffff 64bit]: assigned
ath11k_pci 0000:01:00.0: MSI vectors: 32
ath11k_pci 0000:01:00.0: wcn6855 hw1.1
mhi mhi0: Requested to power ON
mhi mhi0: Power on setup success
mhi mhi0: Wait for device to enter SBL or Mission mode
ath11k_pci 0000:01:00.0: chip_id 0x0 chip_family 0xb board_id 0x6 soc_id 0x400c0110
ath11k_pci 0000:01:00.0: fw_version 0x110c80c8 fw_build_timestamp 2021-05-25 21:43 fw_build_id WLAN.HSP.1.1.c3-00200-QCAHSPSWPL_V1_V2_SILICONZ-1
ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM
ath11k_pci 0000:01:00.0: ignore reset dev flags 0xc800
ath11k_pci 0000:01:00.0: failed to receive wmi unified ready event: -110
ath11k_pci 0000:01:00.0: failed to start core: -110
failed to send QMI message
ath11k_pci 0000:01:00.0: failed to send wlan mode request (mode 4): -5
ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -5
>
> /jeff
>
>
--
With best wishes
Dmitry
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-06-11 20:03 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1104856
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-06-11 20:03 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1110215
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] ea6b63: profiles/audio/bass: Use BASS_Modify_Source when a...
From: Luiz Augusto von Dentz @ 2026-06-11 20:02 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: ea6b63562d9d249b5925d09813aa01510123aae8
https://github.com/bluez/bluez/commit/ea6b63562d9d249b5925d09813aa01510123aae8
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M profiles/audio/bass.c
Log Message:
-----------
profiles/audio/bass: Use BASS_Modify_Source when assistant is active
When a MediaAssistant is already active (streaming), a subsequent Push
should send Modify Source with PA_SYNC_NO_SYNC and bis_sync=0 to
remove the broadcast source, rather than adding a duplicate source.
Split push() into push_add_src() and push_mod_src() helpers. The push
dispatcher checks the assistant state: ACTIVE non-local assistants and
LOCAL assistants with a tracked source entry both route to
push_mod_src, while all others proceed with push_add_src.
Add per-device source tracking for LOCAL assistants via a bass_src
struct (keyed by bt_bass pointer) stored in a per-assistant srcs
queue. This is needed because LOCAL assistants never change state, so
we cannot rely on the state machine alone to detect active sources.
Also fix the bass_src_changed BID filter: the previous check rejected
non-local assistants when BID was zero, but this incorrectly excluded
LOCAL assistants in REQUESTING state whose BID happens to be non-zero.
Change to reject assistants whose own BID is non-zero when the
notification BID is zero, which correctly matches local streams.
Commit: 590aae8b695082185b2354e9f194078804fd9f2b
https://github.com/bluez/bluez/commit/590aae8b695082185b2354e9f194078804fd9f2b
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M profiles/audio/bass.c
M src/shared/bass.c
Log Message:
-----------
profiles/audio/bass: Handle PA_SYNC_NO_SYNC in handle_mod_src_req
When the delegator receives a Modify Source operation with pa_sync set
to PA_SYNC_NO_SYNC while already synchronized to PA, release all
setups instead of updating BIS sync which would not apply the
requested termination.
Also reset the encryption state to no encryption when the last BIS
index is cleared from a subgroup, so subsequent source additions
start with a clean encryption state.
Commit: 5b0c20727569e0ad6fee2c7d92dd375fa0fb45b1
https://github.com/bluez/bluez/commit/5b0c20727569e0ad6fee2c7d92dd375fa0fb45b1
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M profiles/audio/bass.c
Log Message:
-----------
profiles/audio/bass: Fix delegator reprobing after disconnect
delegator_disconnect left the old delegator in the delegators queue
after calling device_remove_profile. When a new delegator was created
for the same device (e.g. on a subsequent Add Source after Modify
Source removal), delegator_attach would find the stale entry and
return early, leaving the new delegator without a service. This
caused the "Unable to probe service" error and prevented the BASS
bcode exchange from working on reconnection.
Fix by removing the delegator from the queue, clearing service user
data, and calling delegator_free before disconnecting the service
and removing the profile. This also fixes a potential use-after-free
where delegator_disconnect accessed dg fields after device_remove_profile
could trigger delegator_detach -> delegator_free through the
bap_detached callback chain.
Also add validation in bass_req_bcode to detect and discard invalid
(all-zeros) broadcast codes that may have been stored from a previous
connection.
Commit: 40f2e34b373944cf8142154881ce69f92c2be68d
https://github.com/bluez/bluez/commit/40f2e34b373944cf8142154881ce69f92c2be68d
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M doc/org.bluez.MediaAssistant.rst
Log Message:
-----------
doc: Document Push behavior when MediaAssistant is active
Document that calling Push on an assistant already in active state uses
BASS_Modify_Source to update the existing source rather than adding a
new one.
Compare: https://github.com/bluez/bluez/compare/5d836f1c697c...40f2e34b3739
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH 7/7] arm64: dts: qcom: sm8350-hdk: describe WiFi/BT chip
From: Dmitry Baryshkov @ 2026-06-11 19:44 UTC (permalink / raw)
To: Konrad Dybcio
Cc: Manivannan Sadhasivam, Lorenzo Pieralisi,
Krzysztof Wilczyński, Rob Herring, Bjorn Helgaas, Qiang Yu,
Jeff Johnson, Liam Girdwood, Mark Brown, Krzysztof Kozlowski,
Conor Dooley, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
Bjorn Andersson, Konrad Dybcio, linux-arm-msm, linux-pci,
linux-kernel, linux-wireless, ath11k, devicetree,
Bartosz Golaszewski, linux-bluetooth
In-Reply-To: <955691e1-e40d-4584-861e-8f29db4ba8a9@oss.qualcomm.com>
On Thu, Jun 11, 2026 at 02:09:27PM +0200, Konrad Dybcio wrote:
> On 6/1/26 11:46 AM, Dmitry Baryshkov wrote:
> > The SM8350 HDK has onboard WiFi/BT chip, WCN6851. It is an earlier
> > version of well-known WCN6855 WiFI/BT SoC. Describe the PMU, BT and WiFI
> > parts of the device.
>
> [...]
>
> > + wcn6855-pmu {
> > + compatible = "qcom,wcn6851-pmu", "qcom,wcn6855-pmu";
> > +
> > + pinctrl-0 = <&bt_en>, <&wlan_en>, <&swctrl>;
> > + pinctrl-names = "default";
> > +
> > + wlan-enable-gpios = <&tlmm 64 GPIO_ACTIVE_HIGH>;
> > + bt-enable-gpios = <&tlmm 65 GPIO_ACTIVE_HIGH>;
> > + swctrl-gpios = <&tlmm 153 GPIO_ACTIVE_HIGH>;
> > +
> > + vddio-supply = <&vreg_s10b_1p8>;
> > + vddaon-supply = <&vreg_s11b_0p95>;
> > + vddpmu-supply = <&vreg_s11b_0p95>;
> > + vddpmumx-supply = <&vreg_s2e_0p85>;
> > + vddpmucx-supply = <&vreg_s11b_0p95>;
> > + vddrfa0p95-supply = <&vreg_s11b_0p95>;
> > + vddrfa1p3-supply = <&vreg_s12b_1p25>;
> > + vddrfa1p9-supply = <&vreg_s1c_1p86>;
> > + vddpcie1p3-supply = <&vreg_s12b_1p25>;
> > + vddpcie1p9-supply = <&vreg_s1c_1p86>;
>
> [...]
>
> > @@ -373,6 +437,13 @@ vreg_l7e_2p8: ldo7 {
> > regulator-name = "vreg_l7e_2p8";
> > regulator-min-microvolt = <2800000>;
> > regulator-max-microvolt = <2800000>;
> > +
> > + /*
> > + * This is used by the RF front-end for which there is
> > + * no way to represent it in DT (yet?).
> > + */
> > + regulator-boot-on;
> > + regulator-always-on;
>
> msm-5.4 maps this to bt-vdd-asd-supply (asd being a keyboard smash,
> perhaps?) - what is its actual use?
WiFI/BT RF front-end, a separate chip containing amplifiers, couplers,
etc.
It is a separate chip (or a module), it is not powered on by the PMU,
etc.
--
With best wishes
Dmitry
^ permalink raw reply
* Re: [v3] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
From: Luiz Augusto von Dentz @ 2026-06-11 19:40 UTC (permalink / raw)
To: linux-bluetooth; +Cc: oss
In-Reply-To: <6a2b0a77.58f6a988.156c41.2a93@mx.google.com>
Hi @Pauli Virtanen
On Thu, Jun 11, 2026 at 3:20 PM <bluez.test.bot@gmail.com> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1110143
>
> ---Test result---
>
> Test Summary:
> CheckPatch PASS 1.03 seconds
> VerifyFixes PASS 0.10 seconds
> VerifySignedoff PASS 0.10 seconds
> GitLint PASS 0.26 seconds
> SubjectPrefix PASS 0.09 seconds
> BuildKernel PASS 25.18 seconds
> CheckAllWarning PASS 27.48 seconds
> CheckSparse PASS 26.19 seconds
> BuildKernel32 PASS 24.16 seconds
> TestRunnerSetup PASS 531.43 seconds
> TestRunner_l2cap-tester PASS 59.98 seconds
> TestRunner_iso-tester PASS 77.10 seconds
> TestRunner_bnep-tester PASS 18.80 seconds
> TestRunner_mgmt-tester FAIL 216.57 seconds
> TestRunner_rfcomm-tester PASS 25.55 seconds
> TestRunner_sco-tester PASS 32.10 seconds
> TestRunner_ioctl-tester PASS 25.34 seconds
> TestRunner_mesh-tester FAIL 25.86 seconds
> TestRunner_smp-tester PASS 23.11 seconds
> TestRunner_userchan-tester PASS 19.69 seconds
> TestRunner_6lowpan-tester FAIL 45.82 seconds
> IncrementalBuild PASS 24.08 seconds
>
> Details
> ##############################
> Test: TestRunner_mgmt-tester - FAIL
> Desc: Run mgmt-tester with test-runner
> Output:
> Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
>
> Failed Test Cases
> Read Exp Feature - Success Failed 0.239 seconds
> ##############################
> Test: TestRunner_mesh-tester - FAIL
> Desc: Run mesh-tester with test-runner
> Output:
> Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
>
> Failed Test Cases
> Mesh - Send cancel - 1 Timed out 2.495 seconds
> Mesh - Send cancel - 2 Timed out 1.994 seconds
> ##############################
> Test: TestRunner_6lowpan-tester - FAIL
> Desc: Run 6lowpan-tester with test-runner
> Output:
> Total: 8, Passed: 3 (37.5%), Failed: 5, Not Run: 0
>
> Failed Test Cases
> Client Connect - Disconnect Timed out 5.057 seconds
> Client Recv Dgram - Success Timed out 4.985 seconds
> Client Recv Raw - Success Timed out 4.996 seconds
> Client Recv IPHC Dgram - Success Timed out 4.997 seconds
> Client Recv IPHC Raw - Success Timed out 4.998 seconds
This seems unrelated to the changes, is this something Bluetooth:
6lowpan: fix cyclic locking warning on netdev unregister would cause
though or perhaps is due some other changes to 6lowpan core?
>
> https://github.com/bluez/bluetooth-next/pull/305
>
> ---
> Regards,
> Linux Bluetooth
>
--
Luiz Augusto von Dentz
^ permalink raw reply
* RE: [v3] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
From: bluez.test.bot @ 2026-06-11 19:20 UTC (permalink / raw)
To: linux-bluetooth, oss
In-Reply-To: <20260611152039.2176565-1-oss@fourdim.xyz>
[-- Attachment #1: Type: text/plain, Size: 2794 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1110143
---Test result---
Test Summary:
CheckPatch PASS 1.03 seconds
VerifyFixes PASS 0.10 seconds
VerifySignedoff PASS 0.10 seconds
GitLint PASS 0.26 seconds
SubjectPrefix PASS 0.09 seconds
BuildKernel PASS 25.18 seconds
CheckAllWarning PASS 27.48 seconds
CheckSparse PASS 26.19 seconds
BuildKernel32 PASS 24.16 seconds
TestRunnerSetup PASS 531.43 seconds
TestRunner_l2cap-tester PASS 59.98 seconds
TestRunner_iso-tester PASS 77.10 seconds
TestRunner_bnep-tester PASS 18.80 seconds
TestRunner_mgmt-tester FAIL 216.57 seconds
TestRunner_rfcomm-tester PASS 25.55 seconds
TestRunner_sco-tester PASS 32.10 seconds
TestRunner_ioctl-tester PASS 25.34 seconds
TestRunner_mesh-tester FAIL 25.86 seconds
TestRunner_smp-tester PASS 23.11 seconds
TestRunner_userchan-tester PASS 19.69 seconds
TestRunner_6lowpan-tester FAIL 45.82 seconds
IncrementalBuild PASS 24.08 seconds
Details
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.239 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.495 seconds
Mesh - Send cancel - 2 Timed out 1.994 seconds
##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:
Total: 8, Passed: 3 (37.5%), Failed: 5, Not Run: 0
Failed Test Cases
Client Connect - Disconnect Timed out 5.057 seconds
Client Recv Dgram - Success Timed out 4.985 seconds
Client Recv Raw - Success Timed out 4.996 seconds
Client Recv IPHC Dgram - Success Timed out 4.997 seconds
Client Recv IPHC Raw - Success Timed out 4.998 seconds
https://github.com/bluez/bluetooth-next/pull/305
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
From: bluez.test.bot @ 2026-06-11 19:09 UTC (permalink / raw)
To: linux-bluetooth, oss
In-Reply-To: <20260611150822.2166160-2-oss@fourdim.xyz>
[-- Attachment #1: Type: text/plain, Size: 6509 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1110137
---Test result---
Test Summary:
CheckPatch PASS 1.67 seconds
VerifyFixes PASS 0.13 seconds
VerifySignedoff PASS 0.12 seconds
GitLint PASS 0.32 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel FAIL 25.18 seconds
CheckAllWarning FAIL 28.90 seconds
CheckSparse FAIL 26.64 seconds
BuildKernel32 FAIL 24.50 seconds
TestRunnerSetup FAIL 510.15 seconds
TestRunner_l2cap-tester FAIL 0.13 seconds
TestRunner_smp-tester FAIL 0.13 seconds
TestRunner_6lowpan-tester FAIL 0.13 seconds
IncrementalBuild PASS 23.83 seconds
Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:
net/bluetooth/6lowpan.c:768:13: error: redefinition of ‘unregister_dev’
768 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: note: previous definition of ‘unregister_dev’ was here
748 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: warning: ‘unregister_dev’ defined but not used [-Wunused-function]
make[4]: *** [scripts/Makefile.build:289: net/bluetooth/6lowpan.o] Error 1
make[3]: *** [scripts/Makefile.build:548: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:548: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2143: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: CheckAllWarning - FAIL
Desc: Run linux kernel with all warning enabled
Output:
net/bluetooth/6lowpan.c:768:13: error: redefinition of ‘unregister_dev’
768 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: note: previous definition of ‘unregister_dev’ was here
748 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: warning: ‘unregister_dev’ defined but not used [-Wunused-function]
make[4]: *** [scripts/Makefile.build:289: net/bluetooth/6lowpan.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:548: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:548: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2143: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: CheckSparse - FAIL
Desc: Run sparse tool with linux kernel
Output:
/github/workspace/src/src/Makefile:1246: C=1 specified, but sparse is not available or not up to date
/github/workspace/src/src/Makefile:1246: C=1 specified, but sparse is not available or not up to date
net/bluetooth/6lowpan.c:768:13: error: redefinition of ‘unregister_dev’
768 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: note: previous definition of ‘unregister_dev’ was here
748 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: warning: ‘unregister_dev’ defined but not used [-Wunused-function]
make[4]: *** [scripts/Makefile.build:289: net/bluetooth/6lowpan.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:548: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:548: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2143: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:
net/bluetooth/6lowpan.c:768:13: error: redefinition of ‘unregister_dev’
768 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: note: previous definition of ‘unregister_dev’ was here
748 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: warning: ‘unregister_dev’ defined but not used [-Wunused-function]
make[4]: *** [scripts/Makefile.build:289: net/bluetooth/6lowpan.o] Error 1
make[3]: *** [scripts/Makefile.build:548: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:548: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2143: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: TestRunnerSetup - FAIL
Desc: Setup kernel and bluez for test-runner
Output:
Kernel:
net/bluetooth/6lowpan.c:768:13: error: redefinition of ‘unregister_dev’
768 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: note: previous definition of ‘unregister_dev’ was here
748 | static void unregister_dev(struct lowpan_btle_dev *dev)
| ^~~~~~~~~~~~~~
net/bluetooth/6lowpan.c:748:13: warning: ‘unregister_dev’ defined but not used [-Wunused-function]
make[4]: *** [scripts/Makefile.build:289: net/bluetooth/6lowpan.o] Error 1
make[3]: *** [scripts/Makefile.build:548: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:548: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/github/workspace/src/src/Makefile:2143: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No kernel image found
##############################
Test: TestRunner_smp-tester - FAIL
Desc: Run smp-tester with test-runner
Output:
No kernel image found
##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:
No kernel image found
https://github.com/bluez/bluetooth-next/pull/304
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ,v1,1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active
From: bluez.test.bot @ 2026-06-11 18:53 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260611172235.92930-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1287 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1110215
---Test result---
Test Summary:
CheckPatch PASS 2.09 seconds
GitLint FAIL 1.33 seconds
BuildEll PASS 20.34 seconds
BluezMake PASS 674.75 seconds
MakeCheck PASS 18.45 seconds
MakeDistcheck PASS 253.93 seconds
CheckValgrind PASS 297.55 seconds
CheckSmatch PASS 354.26 seconds
bluezmakeextell PASS 184.12 seconds
IncrementalBuild PASS 688.14 seconds
ScanBuild PASS 1047.70 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v1,1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active
1: T1 Title exceeds max length (83>80): "[BlueZ,v1,1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active"
https://github.com/bluez/bluez/pull/2218
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH BlueZ v1 1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active
From: patchwork-bot+bluetooth @ 2026-06-11 18:50 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <20260611172235.92930-1-luiz.dentz@gmail.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 11 Jun 2026 13:22:32 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> When a MediaAssistant is already active (streaming), a subsequent Push
> should send Modify Source with PA_SYNC_NO_SYNC and bis_sync=0 to
> remove the broadcast source, rather than adding a duplicate source.
>
> Split push() into push_add_src() and push_mod_src() helpers. The push
> dispatcher checks the assistant state: ACTIVE non-local assistants and
> LOCAL assistants with a tracked source entry both route to
> push_mod_src, while all others proceed with push_add_src.
>
> [...]
Here is the summary with links:
- [BlueZ,v1,1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ea6b63562d9d
- [BlueZ,v1,2/4] profiles/audio/bass: Handle PA_SYNC_NO_SYNC in handle_mod_src_req
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=590aae8b6950
- [BlueZ,v1,3/4] profiles/audio/bass: Fix delegator reprobing after disconnect
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5b0c20727569
- [BlueZ,v1,4/4] doc: Document Push behavior when MediaAssistant is active
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=40f2e34b3739
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [GIT PULL] bluetooth-next 2026-06-11
From: Luiz Augusto von Dentz @ 2026-06-11 18:33 UTC (permalink / raw)
To: davem, kuba; +Cc: linux-bluetooth, netdev
The following changes since commit 518d8d0199538a4d6d5e51064044ece71e0c42e7:
net: sched: avoid printing uninitialized link speed (2026-06-11 15:44:55 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git tags/for-net-next-2026-06-11
for you to fetch changes up to f70f7f2512c6b9113dc78f6a25361166afd1412e:
Bluetooth: btintel_pcie: Separate coredump work from RX work (2026-06-11 14:24:42 -0400)
----------------------------------------------------------------
bluetooth-next pull request for net-next:
core:
- hci_sync: Add support for HCI_LE_Set_Host_Feature [v2]
- SMP: Use AES-CMAC library API
- sockets: convert to getsockopt_iter
- Add SPDX id lines to some source files
drivers:
- btintel_pcie: Support Product level reset
- btintel_pcie: Add support for smart trigger dump
- btintel_pcie: Add 50 ms delay before MAC init on BlazarIW
- btintel_pcie: Separate coredump work from RX work
- btmtk: add event filter to filter specific event
- btrtl: fix RTL8761B/BU broken LE extended scan
- btusb: Add Realtek RTL8922AE VID/PID 0bda/d922
- btusb: Add Realtek RTL8922AE VID/PID 0bda/d923
- btusb: MT7922: Add VID/PID 0e8d/223c
- btusb: MT7925: Add VID/PID 0e8d/8c38
- btusb: Add support for TP-Link TL-UB250
- btusb: Add Mercusys MA530 for Realtek RTL8761BUV
- btusb: Add TP-Link UB600 for Realtek 8761BUV
- btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
- btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
- btusb: MT7925: Add VID/PID 13d3/3609
----------------------------------------------------------------
Alexej Sidorenko (1):
Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
Breno Leitao (6):
Bluetooth: hci_sock: write the full optval for getsockopt
Bluetooth: hci_sock: convert to getsockopt_iter
Bluetooth: ISO: convert to getsockopt_iter
Bluetooth: RFCOMM: convert to getsockopt_iter
Bluetooth: L2CAP: convert to getsockopt_iter
Bluetooth: SCO: convert to getsockopt_iter
Chandrashekar Devegowda (1):
Bluetooth: btintel_pcie: Support Product level reset
Chen Zhang (2):
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922
Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923
Chris Lu (3):
Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c
Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38
Bluetooth: btmtk: add event filter to filter specific event
Cris (1):
Bluetooth: btusb: Add support for TP-Link TL-UB250
Eric Biggers (2):
Bluetooth: Remove unneeded crypto kconfig selections
Bluetooth: SMP: Use AES-CMAC library API
Ethan Nelson-Moore (1):
bluetooth: remove all PCMCIA drivers
Hrvoje Nuic (1):
Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
Jiajia Liu (2):
Bluetooth: btmtk: remove extra copy in cmd array init
Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
Johan Hovold (5):
Bluetooth: btusb: fix use-after-free on registration failure
Bluetooth: btusb: fix use-after-free on marvell probe failure
Bluetooth: btusb: fix wakeup source leak on probe failure
Bluetooth: btusb: fix wakeup irq devres lifetime
Bluetooth: btusb: clean up probe error handling
Jordan Walters (1):
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
Kiran K (2):
Bluetooth: btintel_pcie: Add support for smart trigger dump
Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW
Luiz Augusto von Dentz (1):
Bluetooth: hci_sync: Add support for HCI_LE_Set_Host_Feature [v2]
Marco Elver (1):
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Nils Helmig (1):
Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
Pauli Virtanen (1):
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
Ravindra (2):
Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
Bluetooth: btintel_pcie: Separate coredump work from RX work
Rong Zhang (1):
Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925
Sai Teja Aluvala (1):
Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant
Samuel Moelius (3):
Bluetooth: hci: validate codec capability element length
Bluetooth: L2CAP: validate connectionless PSM length
Bluetooth: vhci: validate devcoredump state before side effects
Sergey Senozhatsky (1):
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
Sergey Shtylyov (1):
Bluetooth: hci_h5: reset hci_uart::priv in the close() method
Tim Bird (1):
Bluetooth: Add SPDX id lines to some source files
Weiming Shi (1):
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
Xiuzhuo Shang (1):
Bluetooth: qca: Add BT FW build version to kernel log
Zenm Chen (1):
Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
Zhao Dongdong (1):
Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
Zijun Hu (2):
Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
luke-yj.chen (1):
Bluetooth: btusb: MT7925: Add VID/PID 13d3/3609
arch/arm/configs/pxa_defconfig | 3 -
arch/arm/configs/spitz_defconfig | 3 -
arch/loongarch/configs/loongson32_defconfig | 3 -
arch/loongarch/configs/loongson64_defconfig | 3 -
arch/mips/configs/mtx1_defconfig | 3 -
arch/powerpc/configs/ppc6xx_defconfig | 3 -
drivers/bluetooth/Kconfig | 42 +-
drivers/bluetooth/Makefile | 3 -
drivers/bluetooth/bluecard_cs.c | 908 ----------------------------
drivers/bluetooth/bt3c_cs.c | 749 -----------------------
drivers/bluetooth/btintel.c | 10 +-
drivers/bluetooth/btintel.h | 9 +
drivers/bluetooth/btintel_pcie.c | 502 +++++++++++++--
drivers/bluetooth/btintel_pcie.h | 26 +-
drivers/bluetooth/btmtk.c | 39 +-
drivers/bluetooth/btmtk.h | 7 +
drivers/bluetooth/btmtksdio.c | 2 +-
drivers/bluetooth/btqca.c | 2 +
drivers/bluetooth/btrsi.c | 12 +-
drivers/bluetooth/btrtl.c | 13 +
drivers/bluetooth/btusb.c | 94 ++-
drivers/bluetooth/dtl1_cs.c | 614 -------------------
drivers/bluetooth/hci_h5.c | 1 +
drivers/bluetooth/hci_qca.c | 11 +-
drivers/bluetooth/hci_vhci.c | 10 +
include/net/bluetooth/bluetooth.h | 5 +-
include/net/bluetooth/hci.h | 11 +-
include/net/bluetooth/hci_core.h | 5 +-
include/net/bluetooth/hci_mon.h | 5 +-
include/net/bluetooth/hci_sock.h | 5 +-
include/net/bluetooth/l2cap.h | 6 +-
include/net/bluetooth/mgmt.h | 5 +-
include/net/bluetooth/rfcomm.h | 5 +-
include/net/bluetooth/sco.h | 5 +-
net/bluetooth/6lowpan.c | 25 +-
net/bluetooth/Kconfig | 6 +-
net/bluetooth/af_bluetooth.c | 5 +-
net/bluetooth/bnep/core.c | 5 +-
net/bluetooth/bnep/netdev.c | 5 +-
net/bluetooth/bnep/sock.c | 5 +-
net/bluetooth/ecdh_helper.c | 5 +-
net/bluetooth/ecdh_helper.h | 5 +-
net/bluetooth/eir.c | 8 +-
net/bluetooth/hci_codec.c | 2 +-
net/bluetooth/hci_conn.c | 5 +-
net/bluetooth/hci_core.c | 7 +-
net/bluetooth/hci_debugfs.c | 5 +-
net/bluetooth/hci_debugfs.h | 5 +-
net/bluetooth/hci_event.c | 12 +-
net/bluetooth/hci_sock.c | 31 +-
net/bluetooth/hci_sync.c | 24 +-
net/bluetooth/hidp/core.c | 5 +-
net/bluetooth/hidp/hidp.h | 5 +-
net/bluetooth/hidp/sock.c | 5 +-
net/bluetooth/iso.c | 27 +-
net/bluetooth/l2cap_core.c | 44 +-
net/bluetooth/l2cap_sock.c | 66 +-
net/bluetooth/lib.c | 5 +-
net/bluetooth/mgmt.c | 5 +-
net/bluetooth/mgmt_util.c | 5 +-
net/bluetooth/mgmt_util.h | 5 +-
net/bluetooth/rfcomm/core.c | 5 +-
net/bluetooth/rfcomm/sock.c | 35 +-
net/bluetooth/rfcomm/tty.c | 5 +-
net/bluetooth/sco.c | 64 +-
net/bluetooth/selftest.c | 5 +-
net/bluetooth/selftest.h | 5 +-
net/bluetooth/smp.c | 185 ++----
net/bluetooth/smp.h | 5 +-
69 files changed, 955 insertions(+), 2810 deletions(-)
delete mode 100644 drivers/bluetooth/bluecard_cs.c
delete mode 100644 drivers/bluetooth/bt3c_cs.c
delete mode 100644 drivers/bluetooth/dtl1_cs.c
^ permalink raw reply
* Re: [GIT PULL] bluetooth 2026-05-28
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260528131839.462344-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 28 May 2026 09:18:39 -0400 you wrote:
> The following changes since commit ab1513597c6cf17cd1ad2a21e3b045421b48e022:
>
> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (2026-05-20 16:35:47 -0400)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-28
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth 2026-05-28
https://git.kernel.org/bluetooth/bluetooth-next/c/2412591cfe66
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1] Bluetooth: MGMT: Fix backward compatibility with userspace
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <20260602205659.212834-1-luiz.dentz@gmail.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 2 Jun 2026 16:56:59 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> bluetoothd has a bug with makes it send extra bytes as part of
> MGMT_OP_ADD_EXT_ADV_DATA which are now being checked to be the
> exact the expected length, relax this so only when the expected
> length is greater than the data length to cause an error since
> that would result in accessing invalid memory, otherwise just
> ignore the extra bytes.
>
> [...]
Here is the summary with links:
- [v1] Bluetooth: MGMT: Fix backward compatibility with userspace
https://git.kernel.org/bluetooth/bluetooth-next/c/149324fc762c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2] Bluetooth: btintel_pcie: Separate coredump work from RX work
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Kiran K
Cc: linux-bluetooth, ravishankar.srivatsa, chethan.tumkur.narayan,
chandrashekar.devegowda, ravindra
In-Reply-To: <20260610162544.240444-1-kiran.k@intel.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Wed, 10 Jun 2026 21:55:44 +0530 you wrote:
> From: Ravindra <ravindra@intel.com>
>
> Sharing a single workqueue between coredump processing and RX
> delays evacuation of RX events while a coredump is in progress.
> The firmware's RX buffers can overflow during that window, leading
> to dropped events. The issue was observed in HID use cases where
> HID reports arrive in bursts and quickly fill the RX path while a
> coredump is being collected.
>
> [...]
Here is the summary with links:
- [v2] Bluetooth: btintel_pcie: Separate coredump work from RX work
https://git.kernel.org/bluetooth/bluetooth-next/c/27e1ec48aeb4
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Sergey Senozhatsky
Cc: marcel, luiz.dentz, mark-yw.chen, sean.wang, tfiga,
linux-bluetooth, linux-kernel, linux-arm-kernel, linux-mediatek,
stable
In-Reply-To: <20260609121329.1262170-1-senozhatsky@chromium.org>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 9 Jun 2026 21:10:06 +0900 you wrote:
> Every once in a while we see a hung btmtksdio_flush() task:
>
> INFO: task kworker/u17:0:189 blocked for more than 122 seconds.
> __cancel_work_timer+0x3f4/0x460
> cancel_work_sync+0x1c/0x2c
> btmtksdio_flush+0x2c/0x40
> hci_dev_open_sync+0x10c4/0x2190
> [..]
>
> [...]
Here is the summary with links:
- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
https://git.kernel.org/bluetooth/bluetooth-next/c/a4263306d01d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth 2026-06-03
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260603162714.342496-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 3 Jun 2026 12:27:14 -0400 you wrote:
> The following changes since commit cdf88b35e06f1b385f7f6228060ae541d44fbb72:
>
> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (2026-05-28 08:52:21 -0400)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-06-03
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth 2026-06-03
https://git.kernel.org/bluetooth/bluetooth-next/c/d20da9130830
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth 2026-05-20
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260520204959.2902497-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 20 May 2026 16:49:58 -0400 you wrote:
> The following changes since commit 375ba7484132662a4a8c7547d088fb6275c00282:
>
> Bluetooth: hci_qca: Convert timeout from jiffies to ms (2026-05-14 09:58:08 -0400)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-20
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth 2026-05-20
https://git.kernel.org/bluetooth/bluetooth-next/c/5027c886e26c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] 6lowpan: fix off-by-one in multicast context address compression
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Yizhou Zhao
Cc: netdev, alex.aring, davem, edumazet, kuba, pabeni, horms,
linux-bluetooth, linux-wpan, linux-kernel, yangyx22, wangao,
fengxw06, qli01, xuke
In-Reply-To: <20260527081806.42747-1-zhaoyz24@mails.tsinghua.edu.cn>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 27 May 2026 16:18:01 +0800 you wrote:
> The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses
> &data[1] as destination and &ipaddr->s6_addr[11] as source, but
> both should be offset by one: &data[2] and &ipaddr->s6_addr[12]
> respectively.
>
> This off-by-one has two consequences:
> 1. data[1] is overwritten with s6_addr[11], corrupting the RIID
> field in the compressed multicast address
> 2. data[5] is never written, so uninitialized kernel stack memory
> is transmitted over the network via lowpan_push_hc_data(),
> leaking kernel stack contents
>
> [...]
Here is the summary with links:
- [net] 6lowpan: fix off-by-one in multicast context address compression
https://git.kernel.org/bluetooth/bluetooth-next/c/2a58899d1100
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth 2026-05-14
From: patchwork-bot+bluetooth @ 2026-06-11 17:58 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260514172340.1515042-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 14 May 2026 13:23:40 -0400 you wrote:
> The following changes since commit c78bdba7b9666020c0832150a4fc4c0aebc7c6ac:
>
> net: phy: DP83TC811: add reading of abilities (2026-05-14 15:17:12 +0200)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-05-14
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth 2026-05-14
https://git.kernel.org/bluetooth/bluetooth-next/c/23f3b04f157c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [bluez/bluez] b5b40a: profiles/audio/bass: Use BASS_Modify_Source when a...
From: Luiz Augusto von Dentz @ 2026-06-11 17:53 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1110215
Home: https://github.com/bluez/bluez
Commit: b5b40a4bd3dd23a5569c616ebaf14126881b7ed1
https://github.com/bluez/bluez/commit/b5b40a4bd3dd23a5569c616ebaf14126881b7ed1
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
M profiles/audio/bass.c
Log Message:
-----------
profiles/audio/bass: Use BASS_Modify_Source when assistant is active
When a MediaAssistant is already active (streaming), a subsequent Push
should send Modify Source with PA_SYNC_NO_SYNC and bis_sync=0 to
remove the broadcast source, rather than adding a duplicate source.
Split push() into push_add_src() and push_mod_src() helpers. The push
dispatcher checks the assistant state: ACTIVE non-local assistants and
LOCAL assistants with a tracked source entry both route to
push_mod_src, while all others proceed with push_add_src.
Add per-device source tracking for LOCAL assistants via a bass_src
struct (keyed by bt_bass pointer) stored in a per-assistant srcs
queue. This is needed because LOCAL assistants never change state, so
we cannot rely on the state machine alone to detect active sources.
Also fix the bass_src_changed BID filter: the previous check rejected
non-local assistants when BID was zero, but this incorrectly excluded
LOCAL assistants in REQUESTING state whose BID happens to be non-zero.
Change to reject assistants whose own BID is non-zero when the
notification BID is zero, which correctly matches local streams.
Commit: e7d235efae7ed33f0ae0df91205277668181e0f4
https://github.com/bluez/bluez/commit/e7d235efae7ed33f0ae0df91205277668181e0f4
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
M profiles/audio/bass.c
M src/shared/bass.c
Log Message:
-----------
profiles/audio/bass: Handle PA_SYNC_NO_SYNC in handle_mod_src_req
When the delegator receives a Modify Source operation with pa_sync set
to PA_SYNC_NO_SYNC while already synchronized to PA, release all
setups instead of updating BIS sync which would not apply the
requested termination.
Also reset the encryption state to no encryption when the last BIS
index is cleared from a subgroup, so subsequent source additions
start with a clean encryption state.
Commit: ef38d6371550e7596888e8198d328c802520bd18
https://github.com/bluez/bluez/commit/ef38d6371550e7596888e8198d328c802520bd18
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
M profiles/audio/bass.c
Log Message:
-----------
profiles/audio/bass: Fix delegator reprobing after disconnect
delegator_disconnect left the old delegator in the delegators queue
after calling device_remove_profile. When a new delegator was created
for the same device (e.g. on a subsequent Add Source after Modify
Source removal), delegator_attach would find the stale entry and
return early, leaving the new delegator without a service. This
caused the "Unable to probe service" error and prevented the BASS
bcode exchange from working on reconnection.
Fix by removing the delegator from the queue, clearing service user
data, and calling delegator_free before disconnecting the service
and removing the profile. This also fixes a potential use-after-free
where delegator_disconnect accessed dg fields after device_remove_profile
could trigger delegator_detach -> delegator_free through the
bap_detached callback chain.
Also add validation in bass_req_bcode to detect and discard invalid
(all-zeros) broadcast codes that may have been stored from a previous
connection.
Commit: ca320ea1e889ef325c64aaf9d41e32acdc7285d0
https://github.com/bluez/bluez/commit/ca320ea1e889ef325c64aaf9d41e32acdc7285d0
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
M doc/org.bluez.MediaAssistant.rst
Log Message:
-----------
doc: Document Push behavior when MediaAssistant is active
Document that calling Push on an assistant already in active state uses
BASS_Modify_Source to update the existing source rather than adding a
new one.
Compare: https://github.com/bluez/bluez/compare/b5b40a4bd3dd%5E...ca320ea1e889
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v1 4/4] doc: Document Push behavior when MediaAssistant is active
From: Luiz Augusto von Dentz @ 2026-06-11 17:22 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260611172235.92930-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Document that calling Push on an assistant already in active state uses
BASS_Modify_Source to update the existing source rather than adding a
new one.
---
doc/org.bluez.MediaAssistant.rst | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/doc/org.bluez.MediaAssistant.rst b/doc/org.bluez.MediaAssistant.rst
index 45143cee8dbf..2f29a7b5c253 100644
--- a/doc/org.bluez.MediaAssistant.rst
+++ b/doc/org.bluez.MediaAssistant.rst
@@ -27,6 +27,10 @@ void Push(dict properties)
Send stream information to the remote device.
+If the assistant is in the "active" state, this method uses
+BASS_Modify_Source to update the existing source on the remote device
+instead of adding a new one with BASS_Add_Source.
+
:dict properties:
Indicate stream properties that will be sent to the peer.
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v1 3/4] profiles/audio/bass: Fix delegator reprobing after disconnect
From: Luiz Augusto von Dentz @ 2026-06-11 17:22 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260611172235.92930-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
delegator_disconnect left the old delegator in the delegators queue
after calling device_remove_profile. When a new delegator was created
for the same device (e.g. on a subsequent Add Source after Modify
Source removal), delegator_attach would find the stale entry and
return early, leaving the new delegator without a service. This
caused the "Unable to probe service" error and prevented the BASS
bcode exchange from working on reconnection.
Fix by removing the delegator from the queue, clearing service user
data, and calling delegator_free before disconnecting the service
and removing the profile. This also fixes a potential use-after-free
where delegator_disconnect accessed dg fields after device_remove_profile
could trigger delegator_detach -> delegator_free through the
bap_detached callback chain.
Also add validation in bass_req_bcode to detect and discard invalid
(all-zeros) broadcast codes that may have been stored from a previous
connection.
---
profiles/audio/bass.c | 35 ++++++++++++++++++++++++++++++-----
1 file changed, 30 insertions(+), 5 deletions(-)
diff --git a/profiles/audio/bass.c b/profiles/audio/bass.c
index 5eb7bff076bb..a5ef80fbc835 100644
--- a/profiles/audio/bass.c
+++ b/profiles/audio/bass.c
@@ -257,9 +257,17 @@ static void bass_req_bcode(struct bt_bap_stream *stream,
}
if (dg->bcode) {
- /* Broadcast Code has already been received before. */
- setup_set_bcode(dg->bcode, setup, reply, reply_data);
- return;
+ uint8_t empty_bcode[BT_BASS_BCAST_CODE_SIZE] = {0};
+
+ if (memcmp(dg->bcode, empty_bcode, BT_BASS_BCAST_CODE_SIZE)) {
+ /* Broadcast Code has already been received before. */
+ setup_set_bcode(dg->bcode, setup, reply, reply_data);
+ return;
+ }
+
+ error("dg %p has invalid bcode", dg);
+ free(dg->bcode);
+ dg->bcode = NULL;
}
/* Create a request for the Broadcast Code. The request
@@ -376,20 +384,37 @@ static void setup_free(void *data)
free(setup);
}
+static void delegator_free(struct bass_delegator *dg);
+
static void delegator_disconnect(struct bass_delegator *dg)
{
struct btd_device *device = dg->device;
struct btd_service *service = dg->service;
+ struct btd_profile *profile = btd_service_get_profile(service);
DBG("%p", dg);
+ /* Remove delegator from the queue and free it before removing the
+ * service profile. This prevents delegator_attach from finding a
+ * stale entry when a new delegator is created for the same device,
+ * and also avoids use-after-free since device_remove_profile may
+ * trigger bap_detached -> delegator_detach which would otherwise
+ * try to free the delegator again.
+ */
+ queue_remove(delegators, dg);
+ btd_service_set_user_data(service, NULL);
+ delegator_free(dg);
+
/* Disconnect service so BAP driver is cleanup properly and bt_bap is
* detached from the device.
*/
btd_service_disconnect(service);
- /* Remove service since delegator shold have been freed at this point */
- device_remove_profile(device, btd_service_get_profile(service));
+ /* Remove service since delegator has been freed at this point.
+ * delegator_detach (triggered by bap_detached) will be a no-op
+ * since the delegator has already been removed from the queue.
+ */
+ device_remove_profile(device, profile);
/* If the device is no longer consider connected it means no other
* service was connected so it has no longer any use and can be safely
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v1 1/4] profiles/audio/bass: Use BASS_Modify_Source when assistant is active
From: Luiz Augusto von Dentz @ 2026-06-11 17:22 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
When a MediaAssistant is already active (streaming), a subsequent Push
should send Modify Source with PA_SYNC_NO_SYNC and bis_sync=0 to
remove the broadcast source, rather than adding a duplicate source.
Split push() into push_add_src() and push_mod_src() helpers. The push
dispatcher checks the assistant state: ACTIVE non-local assistants and
LOCAL assistants with a tracked source entry both route to
push_mod_src, while all others proceed with push_add_src.
Add per-device source tracking for LOCAL assistants via a bass_src
struct (keyed by bt_bass pointer) stored in a per-assistant srcs
queue. This is needed because LOCAL assistants never change state, so
we cannot rely on the state machine alone to detect active sources.
Also fix the bass_src_changed BID filter: the previous check rejected
non-local assistants when BID was zero, but this incorrectly excluded
LOCAL assistants in REQUESTING state whose BID happens to be non-zero.
Change to reject assistants whose own BID is non-zero when the
notification BID is zero, which correctly matches local streams.
---
profiles/audio/bass.c | 176 +++++++++++++++++++++++++++++++++++-------
1 file changed, 150 insertions(+), 26 deletions(-)
diff --git a/profiles/audio/bass.c b/profiles/audio/bass.c
index 1fd7704a77a2..f018f8b3ad7f 100644
--- a/profiles/audio/bass.c
+++ b/profiles/audio/bass.c
@@ -108,9 +108,16 @@ struct bass_assistant {
struct iovec *meta;
struct iovec *caps;
enum assistant_state state;
+ uint8_t src_id;
+ struct queue *srcs; /* Per-device source tracking */
char *path;
};
+struct bass_src {
+ struct bt_bass *bass;
+ uint8_t src_id;
+};
+
struct bass_delegator {
struct btd_device *device; /* Broadcast source device */
struct btd_service *service;
@@ -158,6 +165,17 @@ static void bass_data_remove(struct bass_data *data);
static void bis_probe(uint8_t sid, uint8_t bis, uint8_t sgrp,
struct iovec *caps, struct iovec *meta,
struct bt_bap_qos *qos, void *user_data);
+
+static bool match_src_data(const void *data, const void *match_data)
+{
+ const struct bass_src *src = data;
+ const struct bt_bass *bass = match_data;
+
+ return src->bass == bass;
+}
+
+static struct bass_src *assistant_add_src(struct bass_assistant *assistant,
+ struct bt_bass *bass, uint8_t id);
static void bis_remove(struct bt_bap *bap, void *user_data);
@@ -1010,35 +1028,62 @@ static void assistant_past(struct bass_assistant *assistant)
free(addr);
}
-static DBusMessage *push(DBusConnection *conn, DBusMessage *msg,
- void *user_data)
+static DBusMessage *push_mod_src(struct bass_assistant *assistant,
+ DBusMessage *msg)
+{
+ struct bt_bass_bcast_audio_scan_cp_hdr hdr;
+ struct bt_bass_mod_src_params params = {0};
+ struct iovec iov = {0};
+ uint32_t bis_sync = 0;
+ uint8_t meta_len = 0;
+ int err;
+
+ hdr.op = BT_BASS_MOD_SRC;
+
+ params.id = assistant->src_id;
+ params.pa_sync = PA_SYNC_NO_SYNC;
+ params.pa_interval = PA_INTERVAL_UNKNOWN;
+ params.num_subgroups = assistant->sgrp + 1;
+
+ util_iov_append(&iov, ¶ms, sizeof(params));
+
+ for (uint8_t sgrp = 0; sgrp < params.num_subgroups; sgrp++) {
+ util_iov_append(&iov, &bis_sync, sizeof(bis_sync));
+ util_iov_append(&iov, &meta_len, sizeof(meta_len));
+ }
+
+ err = bt_bass_send(assistant->data->bass, &hdr, &iov);
+ if (err) {
+ DBG("Unable to send BASS Write Command");
+ return btd_error_failed(msg, strerror(-err));
+ }
+
+ free(iov.iov_base);
+
+ if (assistant->device) {
+ assistant_set_state(assistant, ASSISTANT_STATE_IDLE);
+ } else {
+ struct bass_src *src;
+
+ src = queue_remove_if(assistant->srcs, match_src_data,
+ assistant->data->bass);
+ free(src);
+ }
+
+ return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
+}
+
+static DBusMessage *push_add_src(struct bass_assistant *assistant,
+ DBusMessage *msg)
{
- struct bass_assistant *assistant = user_data;
struct bt_bass_bcast_audio_scan_cp_hdr hdr;
struct bt_bass_add_src_params params = {0};
struct iovec iov = {0};
uint32_t bis_sync = 0;
uint8_t meta_len = 0;
int err;
- DBusMessageIter props, dict;
struct io *io;
- DBG("");
-
- dbus_message_iter_init(msg, &props);
-
- if (dbus_message_iter_get_arg_type(&props) != DBUS_TYPE_ARRAY) {
- DBG("Unable to parse properties");
- return btd_error_invalid_args(msg);
- }
-
- dbus_message_iter_recurse(&props, &dict);
-
- if (assistant_parse_props(assistant, &dict)) {
- DBG("Unable to parse properties");
- return btd_error_invalid_args(msg);
- }
-
hdr.op = BT_BASS_ADD_SRC;
if (assistant->device) {
@@ -1130,11 +1175,52 @@ static DBusMessage *push(DBusConnection *conn, DBusMessage *msg,
free(iov.iov_base);
- assistant_set_state(assistant, ASSISTANT_STATE_PENDING);
+ if (assistant->state == ASSISTANT_STATE_LOCAL)
+ assistant_add_src(assistant, assistant->data->bass, 0);
+ else
+ assistant_set_state(assistant, ASSISTANT_STATE_PENDING);
return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
}
+static DBusMessage *push(DBusConnection *conn, DBusMessage *msg,
+ void *user_data)
+{
+ struct bass_assistant *assistant = user_data;
+ DBusMessageIter props, dict;
+
+ DBG("");
+
+ dbus_message_iter_init(msg, &props);
+
+ if (dbus_message_iter_get_arg_type(&props) != DBUS_TYPE_ARRAY) {
+ DBG("Unable to parse properties");
+ return btd_error_invalid_args(msg);
+ }
+
+ dbus_message_iter_recurse(&props, &dict);
+
+ if (assistant_parse_props(assistant, &dict)) {
+ DBG("Unable to parse properties");
+ return btd_error_invalid_args(msg);
+ }
+
+ if (assistant->state == ASSISTANT_STATE_ACTIVE) {
+ return push_mod_src(assistant, msg);
+ } else if (assistant->state == ASSISTANT_STATE_LOCAL) {
+ struct bass_src *src;
+
+ src = queue_find(assistant->srcs, match_src_data,
+ assistant->data->bass);
+ if (src) {
+ assistant->src_id = src->src_id;
+ return push_mod_src(assistant, msg);
+ }
+ }
+
+ return push_add_src(assistant, msg);
+}
+
static const GDBusMethodTable assistant_methods[] = {
{GDBUS_EXPERIMENTAL_ASYNC_METHOD("Push",
GDBUS_ARGS({ "Props", "a{sv}" }),
@@ -1235,6 +1321,7 @@ static void assistant_free(void *data)
g_free(assistant->path);
util_iov_free(assistant->meta, 1);
util_iov_free(assistant->caps, 1);
+ queue_destroy(assistant->srcs, free);
free(assistant);
}
@@ -2015,9 +2102,33 @@ static void bass_handle_bcode_req(struct bass_assistant *assistant, int id)
free(iov.iov_base);
}
+static struct bass_src *assistant_add_src(struct bass_assistant *assistant,
+ struct bt_bass *bass, uint8_t id)
+{
+ struct bass_src *src;
+
+ if (!assistant->srcs)
+ assistant->srcs = queue_new();
+
+ src = queue_find(assistant->srcs, match_src_data, bass);
+ if (src) {
+ src->src_id = id;
+ return src;
+ }
+
+ src = new0(struct bass_src, 1);
+ src->bass = bass;
+ src->src_id = id;
+
+ queue_push_tail(assistant->srcs, src);
+
+ return src;
+}
+
static void bass_src_changed(uint8_t id, uint32_t bid, uint8_t state,
uint8_t enc, uint32_t bis_sync, void *user_data)
{
+ struct bass_data *data = user_data;
const struct queue_entry *entry;
for (entry = queue_get_entries(assistants); entry;
@@ -2032,9 +2143,9 @@ static void bass_src_changed(uint8_t id, uint32_t bid, uint8_t state,
continue;
/* If BID is not set it may happen to be local stream so ignore
- * non-local assistants.
+ * non-local assistants unless their BID is also not set.
*/
- if (!bid && assistant->state != ASSISTANT_STATE_LOCAL)
+ if (!bid && assistant->bid)
continue;
if (state == BT_BASS_SYNC_INFO_RE) {
@@ -2066,21 +2177,34 @@ static void bass_src_changed(uint8_t id, uint32_t bid, uint8_t state,
break;
/* Match BIS index */
- if (bis & bis_sync)
+ if (bis & bis_sync) {
+ assistant->src_id = id;
assistant_set_state(assistant,
ASSISTANT_STATE_ACTIVE);
+ }
break;
case BT_BASS_BIG_ENC_STATE_DEC:
/* Only handle assistant objects that
* have requested a Broadcast Code
*/
- if (assistant->state != ASSISTANT_STATE_REQUESTING)
+ if (assistant->state != ASSISTANT_STATE_REQUESTING &&
+ assistant->state != ASSISTANT_STATE_LOCAL)
break;
/* Match BIS index */
- if (bis & bis_sync)
+ if (bis & bis_sync) {
+ assistant->src_id = id;
+
+ if (assistant->state ==
+ ASSISTANT_STATE_LOCAL) {
+ assistant_add_src(assistant, data->bass,
+ id);
+ break;
+ }
+
assistant_set_state(assistant,
ASSISTANT_STATE_ACTIVE);
+ }
break;
default:
continue;
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v1 2/4] profiles/audio/bass: Handle PA_SYNC_NO_SYNC in handle_mod_src_req
From: Luiz Augusto von Dentz @ 2026-06-11 17:22 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260611172235.92930-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
When the delegator receives a Modify Source operation with pa_sync set
to PA_SYNC_NO_SYNC while already synchronized to PA, release all
setups instead of updating BIS sync which would not apply the
requested termination.
Also reset the encryption state to no encryption when the last BIS
index is cleared from a subgroup, so subsequent source additions
start with a clean encryption state.
---
profiles/audio/bass.c | 72 ++++++++++++++++++++++++++++++++++++++++---
src/shared/bass.c | 6 ++++
2 files changed, 73 insertions(+), 5 deletions(-)
diff --git a/profiles/audio/bass.c b/profiles/audio/bass.c
index f018f8b3ad7f..5eb7bff076bb 100644
--- a/profiles/audio/bass.c
+++ b/profiles/audio/bass.c
@@ -420,7 +420,13 @@ static void setup_clear(struct bass_setup *setup, int bis)
bt_bass_clear_bis_sync(dg->src, bis);
setup->stream = NULL;
- queue_remove(setup->dg->setups, setup);
+
+ if (!queue_remove(setup->dg->setups, setup))
+ /* Setup has already been removed from the queue (e.g. during
+ * handle_mod_src_req PA_SYNC_NO_SYNC processing). Skip
+ * disconnect check and free since the caller handles cleanup.
+ */
+ return;
/* Remove any pending bcode request associated with setup */
req = queue_remove_if(dg->bcode_reqs, match_bcode_setup, setup);
@@ -596,6 +602,8 @@ static void bass_remove_bis(struct bass_setup *setup)
{
struct queue *links = bt_bap_stream_io_get_links(setup->stream);
+ DBG("%p", setup);
+
queue_foreach(links, stream_unlink, setup->stream);
bt_bap_stream_release(setup->stream, NULL, NULL);
}
@@ -618,6 +626,8 @@ static void setup_disable_streaming(void *data, void *user_data)
static void bass_add_bis(struct bass_setup *setup)
{
+ DBG("%p", setup);
+
queue_foreach(setup->dg->setups, setup_disable_streaming, NULL);
setup_configure_stream(setup);
}
@@ -1941,8 +1951,40 @@ static int handle_set_bcode_req(struct bt_bcast_src *bcast_src,
return 0;
}
+static bool check_bis_sync(struct bt_bass_mod_src_params *params, uint8_t bis)
+{
+ uint32_t bitmask = 1 << (bis - 1);
+ struct iovec iov = {
+ .iov_base = params->subgroup_data,
+ .iov_len = 0,
+ };
+
+ /* Calculate subgroup data length based on each subgroup's
+ * bis_sync (4 bytes) + meta_len (1 byte) + meta fields.
+ */
+ for (uint8_t i = 0; i < params->num_subgroups; i++) {
+ uint32_t bis_sync;
+ uint8_t meta_len;
+
+ iov.iov_len += sizeof(bis_sync) + sizeof(meta_len);
+
+ memcpy(&bis_sync, params->subgroup_data + iov.iov_len -
+ sizeof(bis_sync) - sizeof(meta_len),
+ sizeof(bis_sync));
+ memcpy(&meta_len, params->subgroup_data + iov.iov_len -
+ sizeof(meta_len), sizeof(meta_len));
+
+ if (le32_to_cpu(bis_sync) & bitmask)
+ return true;
+
+ iov.iov_len += meta_len;
+ }
+
+ return false;
+}
+
static void bass_update_bis_sync(struct bass_delegator *dg,
- struct bt_bcast_src *bcast_src)
+ struct bt_bass_mod_src_params *params)
{
const struct queue_entry *entry;
@@ -1954,11 +1996,14 @@ static void bass_update_bis_sync(struct bass_delegator *dg,
state = bt_bap_stream_get_state(setup->stream);
- if (!setup->stream && bt_bass_check_bis(bcast_src, setup->bis))
+ DBG("stream %p: BIS %d state %s(%u)", setup->stream, setup->bis,
+ bt_bap_stream_statestr(state), state);
+
+ if (!setup->stream && check_bis_sync(params, setup->bis))
bass_add_bis(setup);
else if (setup->stream &&
state == BT_BAP_STREAM_STATE_STREAMING &&
- !bt_bass_check_bis(bcast_src, setup->bis))
+ !check_bis_sync(params, setup->bis))
bass_remove_bis(setup);
}
}
@@ -1981,9 +2026,26 @@ static int handle_mod_src_req(struct bt_bcast_src *bcast_src,
if (err)
return err;
+ DBG("PA sync state %d", sync_state);
+
switch (sync_state) {
case BT_BASS_SYNCHRONIZED_TO_PA:
- bass_update_bis_sync(dg, bcast_src);
+ if (params->pa_sync == PA_SYNC_NO_SYNC) {
+ /* Release all setups. Note: bass_remove_bis may
+ * trigger synchronous state transitions that call
+ * setup_clear which will return early since the
+ * setup has already been removed from the queue.
+ */
+ struct bass_setup *setup;
+
+ while ((setup = queue_pop_head(dg->setups))) {
+ bass_remove_bis(setup);
+ setup_free(setup);
+ }
+
+ delegator_disconnect(dg);
+ } else
+ bass_update_bis_sync(dg, params);
break;
case BT_BASS_NOT_SYNCHRONIZED_TO_PA:
if (params->pa_sync == PA_SYNC_NO_PAST) {
diff --git a/src/shared/bass.c b/src/shared/bass.c
index 19cc9531d617..65ee4a8cbb18 100644
--- a/src/shared/bass.c
+++ b/src/shared/bass.c
@@ -1930,6 +1930,12 @@ int bt_bass_clear_bis_sync(struct bt_bcast_src *bcast_src, uint8_t bis)
if (sgrp->bis_sync & bitmask) {
sgrp->bis_sync &= ~bitmask;
+ /* If there are no BIS index left then reset encryption
+ * state to no encryption.
+ */
+ if (!sgrp->bis_sync)
+ bcast_src->enc = BT_BASS_BIG_ENC_STATE_NO_ENC;
+
iov = bass_parse_bcast_src(bcast_src);
if (!iov)
return -ENOMEM;
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox