[PATCH] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[PATCH] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[Kyle Pepper]

On controllers without LL Privacy, the accept list cannot match a bonded
peer identity against the peer Resolvable Private Address. Background
scans using the accept-list filter therefore hide those advertisements
from host-side address resolution and auto-connect never starts.

When a pending peer has an IRK but controller-side resolution is
unavailable, use unfiltered scanning while the host is awake. Keep
accept-list filtering during suspend, where host-side resolution cannot
run.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Submission review notes (not part of the commit message):
The downstream N8/UB500 recovers an ACL link after range loss.
No patch-off comparison or changed-RPA necessity test was supplied.
Do not equate link reconnection with automatic audio/application resume.
Privacy-capable and suspend/wake regressions remain coverage gaps.

 net/bluetooth/hci_sync.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index efbd2e538..d0fbb3e08 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -2907,6 +2907,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 	struct bdaddr_list *b, *t;
 	u8 num_entries = 0;
 	bool pend_conn, pend_report;
+	bool rpa_no_llp = false;
 	u8 filter_policy;
 	size_t i, n;
 	int err;
@@ -3025,6 +3026,17 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 			kvfree(params);
 			goto done;
 		}
+
+		/* A bonded peer that advertises with a Resolvable Private
+		 * Address can only be matched by the controller's accept list
+		 * if the controller can resolve addresses itself (LL Privacy).
+		 * When it cannot, note the peer so the scan below can fall back
+		 * to host-side resolution instead of accept list filtering.
+		 */
+		if (!ll_privacy_capable(hdev) &&
+		    hci_find_irk_by_addr(hdev, &params[i].addr,
+					 params[i].addr_type))
+			rpa_no_llp = true;
 	}
 
 	kvfree(params);
@@ -3047,6 +3059,11 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 			kvfree(params);
 			goto done;
 		}
+
+		if (!ll_privacy_capable(hdev) &&
+		    hci_find_irk_by_addr(hdev, &params[i].addr,
+					 params[i].addr_type))
+			rpa_no_llp = true;
 	}
 
 	kvfree(params);
@@ -3061,6 +3078,16 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 	    hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
 		err = -EINVAL;
 
+	/* If a pending peer advertises with an RPA but the controller cannot
+	 * resolve addresses (no LL Privacy), accept list filtering would drop
+	 * its resolvable adverts and it could never be reconnected. Scan
+	 * unfiltered instead so the host resolves the RPA in software and
+	 * triggers the connection (see process_adv_report()). Skipped while
+	 * suspended, where host-side resolution is not available.
+	 */
+	if (rpa_no_llp && !hdev->suspended)
+		err = -EINVAL;
+
 done:
 	filter_policy = err ? 0x00 : 0x01;
 

base-commit: 964430c038967fd06643e866f68115664e1a1bd1

RE: Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1184325/

---Test result---

Test Summary:
CheckPatch                    PASS      0.57 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.06 seconds
GitLint                       PASS      0.21 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      29.32 seconds
CheckAllWarning               PASS      33.44 seconds
CheckSparse                   PASS      35.57 seconds
BuildKernel32                 PASS      29.06 seconds
CheckKernelLLVM               PASS      34.72 seconds
TestRunnerSetup               PASS      695.31 seconds
TestRunner_l2cap-tester       PASS      12.71 seconds
TestRunner_iso-tester         PASS      10.63 seconds
TestRunner_bnep-tester        PASS      3.04 seconds
TestRunner_mgmt-tester        PASS      87.21 seconds
TestRunner_rfcomm-tester      PASS      4.38 seconds
TestRunner_sco-tester         PASS      5.54 seconds
TestRunner_ioctl-tester       PASS      4.57 seconds
TestRunner_mesh-tester        PASS      5.43 seconds
TestRunner_smp-tester         PASS      4.23 seconds
TestRunner_userchan-tester    PASS      3.15 seconds
TestRunner_6lowpan-tester     PASS      4.33 seconds
IncrementalBuild              PASS      34.31 seconds



https://github.com/bluez/bluetooth-next/pull/906

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[Luiz Augusto von Dentz]

Hi Kyle,

On Mon, Oct 12, 2026 at 11:13 PM Kyle Pepper <cochcoder@proton.me> wrote:
>
> On controllers without LL Privacy, the accept list cannot match a bonded
> peer identity against the peer Resolvable Private Address. Background
> scans using the accept-list filter therefore hide those advertisements
> from host-side address resolution and auto-connect never starts.
>
> When a pending peer has an IRK but controller-side resolution is
> unavailable, use unfiltered scanning while the host is awake. Keep
> accept-list filtering during suspend, where host-side resolution cannot
> run.
>
> Assisted-by: OpenCode:gpt-6.1-sol
> Signed-off-by: Kyle Pepper <cochcoder@proton.me>
> ---
> Submission review notes (not part of the commit message):
> The downstream N8/UB500 recovers an ACL link after range loss.
> No patch-off comparison or changed-RPA necessity test was supplied.
> Do not equate link reconnection with automatic audio/application resume.
> Privacy-capable and suspend/wake regressions remain coverage gaps.
>
>  net/bluetooth/hci_sync.c | 27 +++++++++++++++++++++++++++
>  1 file changed, 27 insertions(+)
>
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index efbd2e538..d0fbb3e08 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -2907,6 +2907,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
>         struct bdaddr_list *b, *t;
>         u8 num_entries = 0;
>         bool pend_conn, pend_report;
> +       bool rpa_no_llp = false;
>         u8 filter_policy;
>         size_t i, n;
>         int err;
> @@ -3025,6 +3026,17 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
>                         kvfree(params);
>                         goto done;
>                 }
> +
> +               /* A bonded peer that advertises with a Resolvable Private
> +                * Address can only be matched by the controller's accept list
> +                * if the controller can resolve addresses itself (LL Privacy).
> +                * When it cannot, note the peer so the scan below can fall back
> +                * to host-side resolution instead of accept list filtering.
> +                */
> +               if (!ll_privacy_capable(hdev) &&
> +                   hci_find_irk_by_addr(hdev, &params[i].addr,
> +                                        params[i].addr_type))
> +                       rpa_no_llp = true;
>         }
>
>         kvfree(params);
> @@ -3047,6 +3059,11 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
>                         kvfree(params);
>                         goto done;
>                 }
> +
> +               if (!ll_privacy_capable(hdev) &&
> +                   hci_find_irk_by_addr(hdev, &params[i].addr,
> +                                        params[i].addr_type))
> +                       rpa_no_llp = true;
>         }
>
>         kvfree(params);
> @@ -3061,6 +3078,16 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
>             hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
>                 err = -EINVAL;
>
> +       /* If a pending peer advertises with an RPA but the controller cannot
> +        * resolve addresses (no LL Privacy), accept list filtering would drop
> +        * its resolvable adverts and it could never be reconnected. Scan
> +        * unfiltered instead so the host resolves the RPA in software and
> +        * triggers the connection (see process_adv_report()). Skipped while
> +        * suspended, where host-side resolution is not available.
> +        */
> +       if (rpa_no_llp && !hdev->suspended)
> +               err = -EINVAL;

Weird, I thought we already captured this case. Perhaps there is a bug
in the code if AI is still flagging it as unsupported. Anyway we need
to mgmt-tester to confirm it.

>  done:
>         filter_policy = err ? 0x00 : 0x01;
>
>
> base-commit: 964430c038967fd06643e866f68115664e1a1bd1
>


-- 
Luiz Augusto von Dentz

[PATCH v2] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[Kyle Pepper]

Restore unfiltered scanning for pending IRK peers when the controller
cannot resolve private addresses. Keep accept-list filtering while
suspended and when forced by periodic advertising synchronization.

Fixes: e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable")
Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes since v1:
- Restore the host-resolution fallback in hci_le_add_accept_list_sync()
  instead of adding per-loop and final-filter bookkeeping.
- Preserve filtering during suspend and forced periodic advertising sync.
- Identify the removal of the old fallback in e209e5ccc5ac.
- Add native mgmt-tester reproduction in the companion BlueZ
  patch "mgmt-tester: Add host-resolved RPA scan checks".

Previous submission:
https://lore.kernel.org/linux-bluetooth/20261013031329.483597-1-cochcoder@proton.me/

Testing on bluetooth-next 609a23989d63, with KASAN and lockdep enabled:
                                upstream   revised
  Auto-connect with IRK           FAIL       PASS
  Background report with IRK      FAIL       PASS
  Auto-connect without IRK        PASS       PASS
  Background report without IRK   PASS       PASS

The cases check scan programming through emulated HCI, as requested by
Luiz. They do not test actual address rotation or radio reconnection.
The complete mgmt suite was also run: upstream 503/512 pass, four fail,
five not run; revision 506/512 pass, one fail, five not run. Both runs
time out in "Set Static Address - Success 2". The upstream run also
fails the two new IRK cases and "LL Privacy - Set Flags 3 (2 Devices to
RL)", already listed as flaky; its pass is not attributed to this fix.
No KASAN/lockdep diagnostic was captured in these runs.

The revised implementation has not been newly tested on physical
hardware. Changed-RPA reconnect, privacy-capable-controller and
suspend/wake regressions remain unverified. No automatic audio-resume
claim is made.

 net/bluetooth/hci_sync.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index efbd2e538..03f706c1f 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -2618,7 +2618,7 @@ static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev,
  */
 static int hci_le_add_accept_list_sync(struct hci_dev *hdev,
 				       struct conn_params *params,
-				       u8 *num_entries)
+				       u8 *num_entries, bool force_filter)
 {
 	struct hci_cp_le_add_to_accept_list cp;
 	int err;
@@ -2631,6 +2631,11 @@ static int hci_le_add_accept_list_sync(struct hci_dev *hdev,
 		return 0;
 	}
 
+	/* Host-resolved peers need unfiltered scanning while awake. */
+	if (!force_filter && !hdev->suspended && !ll_privacy_capable(hdev) &&
+	    hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
+		return -EINVAL;
+
 	/* Select filter policy to accept all advertising */
 	if (*num_entries >= hdev->le_accept_list_size)
 		return -ENOSPC;
@@ -2956,7 +2961,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 
 			num_entries = 1;
 			err = hci_le_add_accept_list_sync(hdev, &pa,
-							  &num_entries);
+							  &num_entries, true);
 			goto done;
 		} else {
 			rcu_read_unlock();
@@ -3020,7 +3025,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 
 	for (i = 0; i < n; ++i) {
 		err = hci_le_add_accept_list_sync(hdev, &params[i],
-						  &num_entries);
+								&num_entries, false);
 		if (err) {
 			kvfree(params);
 			goto done;
@@ -3042,7 +3047,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
 
 	for (i = 0; i < n; ++i) {
 		err = hci_le_add_accept_list_sync(hdev, &params[i],
-						  &num_entries);
+								&num_entries, false);
 		if (err) {
 			kvfree(params);
 			goto done;

base-commit: 609a23989d637e2f90522a37c62e65c8c9b8b0ff

RE: [v2] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1604 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1185253/

---Test result---

Test Summary:
CheckPatch                    PASS      0.37 seconds
VerifyFixes                   PASS      0.05 seconds
VerifySignedoff               PASS      0.05 seconds
GitLint                       PASS      0.16 seconds
SubjectPrefix                 PASS      0.43 seconds
BuildKernel                   PASS      16.98 seconds
CheckAllWarning               PASS      20.72 seconds
CheckSparse                   PASS      21.42 seconds
BuildKernel32                 PASS      18.06 seconds
CheckKernelLLVM               PASS      20.43 seconds
TestRunnerSetup               PASS      398.16 seconds
TestRunner_l2cap-tester       PASS      12.66 seconds
TestRunner_iso-tester         PASS      8.56 seconds
TestRunner_bnep-tester        PASS      2.64 seconds
TestRunner_mgmt-tester        PASS      79.86 seconds
TestRunner_rfcomm-tester      PASS      3.84 seconds
TestRunner_sco-tester         PASS      4.76 seconds
TestRunner_ioctl-tester       PASS      3.97 seconds
TestRunner_mesh-tester        PASS      4.85 seconds
TestRunner_smp-tester         PASS      3.81 seconds
TestRunner_userchan-tester    PASS      2.64 seconds
TestRunner_6lowpan-tester     PASS      3.80 seconds
IncrementalBuild              PASS      17.09 seconds



https://github.com/bluez/bluetooth-next/pull/927

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 14 Oct 2026 05:16:20 +0000 you wrote:
> Restore unfiltered scanning for pending IRK peers when the controller
> cannot resolve private addresses. Keep accept-list filtering while
> suspended and when forced by periodic advertising synchronization.
> 
> Fixes: e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable")
> Assisted-by: OpenCode:gpt-6.1-sol
> Signed-off-by: Kyle Pepper <cochcoder@proton.me>
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs
    https://git.kernel.org/bluetooth/bluetooth-next/c/81a78b10d770

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html