[RFC PATCH] mgmt-tester: Add host-resolved RPA scan checks

[Kyle Pepper <cochcoder@proton.me>]

Check unfiltered passive scanning for IRK peers on controllers without
LL Privacy, with auto-connect and background-report controls.

Assisted-by: OpenCode:gpt-6.1-sol
---
Companion to the kernel v2 "Bluetooth: hci_sync: scan unfiltered for
host-resolved RPAs", responding to Luiz's mgmt-tester request in:
https://lore.kernel.org/linux-bluetooth/20261013031329.483597-1-cochcoder@proton.me/

This is the first submission of these BlueZ tests, not a v2 and not a
cross-project apply-order series. It applies independently on BlueZ
9dc7e40962f1. The IRK cases intentionally fail on an unfixed kernel.

Native results on bluetooth-next 609a23989d63, KASAN/lockdep enabled:
                                upstream   revised kernel
  Auto-connect with IRK           FAIL       PASS
  Background report with IRK      FAIL       PASS
  Auto-connect without IRK        PASS       PASS
  Background report without IRK   PASS       PASS

These assert passive-scan programming, not physical address rotation or
successful radio reconnect. On the complete 512-case mgmt run, upstream
has 503 pass/four fail/five not run; revision has 506 pass/one fail/five
not run. Both have the "Set Static Address - Success 2" timeout. The
upstream run also fails the two new IRK tests and the already-listed
flaky "LL Privacy - Set Flags 3 (2 Devices to RL)" test. The latter's
pass is not attributed to the RPA fix. No captured KASAN/lockdep alerts.

Maintainer-mode sanitizer build and 35/35 unit binaries pass. The
complete mgmt suite is not clean; no physical hardware test is claimed.

 tools/mgmt-tester.c | 119 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)

diff --git a/tools/mgmt-tester.c b/tools/mgmt-tester.c
index 992351e2e3..850d38e4ce 100644
--- a/tools/mgmt-tester.c
+++ b/tools/mgmt-tester.c
@@ -10667,6 +10667,114 @@ static const char load_irks_le_public_param_1[] = {
 	0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
 };
 
+static const uint8_t host_rpa_report_param[] = {
+	0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc,
+	0x01,
+	0x00,
+};
+
+static const struct bt_hci_cmd_le_set_scan_parameters host_rpa_unfiltered = {
+	.filter_policy = 0x00,
+};
+
+static const struct bt_hci_cmd_le_set_scan_parameters host_rpa_filtered = {
+	.filter_policy = 0x01,
+};
+
+static int host_rpa_unfiltered_check(const void *param, uint16_t length)
+{
+	const struct bt_hci_cmd_le_set_scan_parameters *cp = param;
+
+	if (length != sizeof(*cp))
+		return -EINVAL;
+
+	return cp->type != 0x00 || cp->filter_policy != 0x00;
+}
+
+static int host_rpa_filtered_check(const void *param, uint16_t length)
+{
+	const struct bt_hci_cmd_le_set_scan_parameters *cp = param;
+
+	if (length != sizeof(*cp))
+		return -EINVAL;
+
+	return cp->type != 0x00 || cp->filter_policy != 0x01;
+}
+
+static const struct generic_data host_rpa_autoconnect = {
+	.setup_settings = settings_powered_le,
+	.setup_send_opcode = MGMT_OP_LOAD_IRKS,
+	.setup_send_param = load_irks_le_public_param_1,
+	.setup_send_len = sizeof(load_irks_le_public_param_1),
+	.send_opcode = MGMT_OP_ADD_DEVICE,
+	.send_param = add_device_le_public_param_1,
+	.send_len = sizeof(add_device_le_public_param_1),
+	.expect_param = add_device_rsp_le_public,
+	.expect_len = sizeof(add_device_rsp_le_public),
+	.expect_status = MGMT_STATUS_SUCCESS,
+	.expect_alt_ev = MGMT_EV_DEVICE_ADDED,
+	.expect_alt_ev_param = add_device_le_public_param_1,
+	.expect_alt_ev_len = sizeof(add_device_le_public_param_1),
+	.expect_hci_command = BT_HCI_CMD_LE_SET_SCAN_PARAMETERS,
+	.expect_hci_param = &host_rpa_unfiltered,
+	.expect_hci_len = sizeof(host_rpa_unfiltered),
+	.expect_hci_param_check_func = host_rpa_unfiltered_check,
+};
+
+static const struct generic_data host_rpa_report = {
+	.setup_settings = settings_powered_le,
+	.setup_send_opcode = MGMT_OP_LOAD_IRKS,
+	.setup_send_param = load_irks_le_public_param_1,
+	.setup_send_len = sizeof(load_irks_le_public_param_1),
+	.send_opcode = MGMT_OP_ADD_DEVICE,
+	.send_param = host_rpa_report_param,
+	.send_len = sizeof(host_rpa_report_param),
+	.expect_param = add_device_rsp_le_public,
+	.expect_len = sizeof(add_device_rsp_le_public),
+	.expect_status = MGMT_STATUS_SUCCESS,
+	.expect_alt_ev = MGMT_EV_DEVICE_ADDED,
+	.expect_alt_ev_param = host_rpa_report_param,
+	.expect_alt_ev_len = sizeof(host_rpa_report_param),
+	.expect_hci_command = BT_HCI_CMD_LE_SET_SCAN_PARAMETERS,
+	.expect_hci_param = &host_rpa_unfiltered,
+	.expect_hci_len = sizeof(host_rpa_unfiltered),
+	.expect_hci_param_check_func = host_rpa_unfiltered_check,
+};
+
+static const struct generic_data host_rpa_no_irk_autoconnect = {
+	.setup_settings = settings_powered_le,
+	.send_opcode = MGMT_OP_ADD_DEVICE,
+	.send_param = add_device_le_public_param_1,
+	.send_len = sizeof(add_device_le_public_param_1),
+	.expect_param = add_device_rsp_le_public,
+	.expect_len = sizeof(add_device_rsp_le_public),
+	.expect_status = MGMT_STATUS_SUCCESS,
+	.expect_alt_ev = MGMT_EV_DEVICE_ADDED,
+	.expect_alt_ev_param = add_device_le_public_param_1,
+	.expect_alt_ev_len = sizeof(add_device_le_public_param_1),
+	.expect_hci_command = BT_HCI_CMD_LE_SET_SCAN_PARAMETERS,
+	.expect_hci_param = &host_rpa_filtered,
+	.expect_hci_len = sizeof(host_rpa_filtered),
+	.expect_hci_param_check_func = host_rpa_filtered_check,
+};
+
+static const struct generic_data host_rpa_no_irk_report = {
+	.setup_settings = settings_powered_le,
+	.send_opcode = MGMT_OP_ADD_DEVICE,
+	.send_param = host_rpa_report_param,
+	.send_len = sizeof(host_rpa_report_param),
+	.expect_param = add_device_rsp_le_public,
+	.expect_len = sizeof(add_device_rsp_le_public),
+	.expect_status = MGMT_STATUS_SUCCESS,
+	.expect_alt_ev = MGMT_EV_DEVICE_ADDED,
+	.expect_alt_ev_param = host_rpa_report_param,
+	.expect_alt_ev_len = sizeof(host_rpa_report_param),
+	.expect_hci_command = BT_HCI_CMD_LE_SET_SCAN_PARAMETERS,
+	.expect_hci_param = &host_rpa_filtered,
+	.expect_hci_len = sizeof(host_rpa_filtered),
+	.expect_hci_param_check_func = host_rpa_filtered_check,
+};
+
 static const uint8_t add_device_le_public_param_2[] = {
 	0x11, 0x22, 0x33, 0x44, 0x55, 0x66,	/* BDADDR */
 	0x01,					/* Type - LE Public */
@@ -15737,6 +15845,17 @@ int main(int argc, char *argv[])
 				&set_exp_feat_unknown,
 				NULL, test_command_generic);
 
+	/* Bluetooth 4.0 has no controller-side address resolution. */
+	test_bredrle("Host RPA - Auto-connect with IRK", &host_rpa_autoconnect,
+				setup_command_generic, test_command_generic);
+	test_bredrle("Host RPA - Background report with IRK", &host_rpa_report,
+				setup_command_generic, test_command_generic);
+	test_bredrle("Host RPA - Auto-connect without IRK",
+				&host_rpa_no_irk_autoconnect, NULL,
+							test_command_generic);
+	test_bredrle("Host RPA - Background report without IRK",
+			&host_rpa_no_irk_report, NULL, test_command_generic);
+
 	/* LL Privacy
 	 * Setup: Enable LE and Power On
 	 * Run: Add new device

base-commit: 9dc7e40962f11d1d9a5568f8a7633a695288329c