[PATCH] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[PATCH] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[Kevin Dewald]

Userspace is not told the parameters of LE connections: the Connection
Subrate event is only sent for LE Connection Rate Change, which needs
the Shorter Connection Interval feature, and nothing is sent when a
connection is established or updated with LE Connection Update
Complete. Applications that need the connection interval, e.g. to
estimate throughput or latency, have to read it from HCI traffic
instead.

Send the Connection Subrate event when an LE connection is established
and after each LE Connection Update, with the interval converted to
units of 0.125 ms. As these do not report subrating, keep the subrate
factor and continuation number of the last connection rate change, or
1 and 0 if there was none.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Kevin Dewald <kevin@simpleble.org>
---
bluetoothd already registers the Connection Subrate event, and only logs
it for now. Once this is merged, I'll send the BlueZ side: it exposes
the parameters as properties of org.bluez.Bearer.LE1 (Interval, Latency,
SupervisionTimeout and Subrate), and documents the new cases of the
event in doc/mgmt-protocol.rst.

I reused the Connection Subrate event since it already carries the
interval, latency and supervision timeout. If you would rather keep it
for the connection rate procedure, I can add a separate event instead.

Tested in test-runner with the functional tests of those BlueZ changes:
with this patch both hosts report the parameters once connected and
after a connection update, and without it neither does. The kernel
testers and the HoG tests, which also watch this event, pass as before.
Only tested with the emulator.

The PHY in use could be reported the same way, but the kernel does not
know which PHY a connection starts on, so that would also need LE Read
PHY after connecting. I left it out for now.

 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_event.c        |  2 ++
 net/bluetooth/mgmt.c             | 20 ++++++++++++++++++++
 3 files changed, 23 insertions(+)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9d5d3ab4a0..89aaae4be5 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2589,6 +2589,7 @@ void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
 				  bdaddr_t *bdaddr, u8 addr_type);
 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
 			      u8 status);
+void mgmt_conn_update_notify(struct hci_dev *hdev, struct hci_conn *conn);
 
 int hci_abort_conn(struct hci_conn *conn, u8 reason);
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d05934fef4..13a8adccb3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6032,6 +6032,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
 	conn->le_conn_interval = interval;
 	conn->le_conn_latency = latency;
 	conn->le_supv_timeout = supervision_timeout;
+	mgmt_conn_update_notify(hdev, conn);
 
 	hci_debugfs_create_conn(conn);
 	hci_conn_add_sysfs(conn);
@@ -6296,6 +6297,7 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
 		conn->le_conn_interval = le16_to_cpu(ev->interval);
 		conn->le_conn_latency = le16_to_cpu(ev->latency);
 		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
+		mgmt_conn_update_notify(hdev, conn);
 	}
 
 	hci_dev_unlock(hdev);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3cb4f9ece8..385c4c543f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -11071,6 +11071,26 @@ void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
 	mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL);
 }
 
+void mgmt_conn_update_notify(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	struct mgmt_ev_conn_subrate ev;
+
+	bacpy(&ev.addr.bdaddr, &conn->dst);
+	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
+	ev.status = MGMT_STATUS_SUCCESS;
+	/* The connection interval is in units of 1.25 ms and the event uses
+	 * units of 0.125 ms. Connection updates don't report subrating, so
+	 * keep the values of the last connection rate change, if any.
+	 */
+	ev.interval = cpu_to_le16(conn->le_conn_interval * 10);
+	ev.subrate = cpu_to_le16(conn->le_subrate ? : 1);
+	ev.latency = cpu_to_le16(conn->le_conn_latency);
+	ev.cont_num = cpu_to_le16(conn->le_cont_num);
+	ev.supv_timeout = cpu_to_le16(conn->le_supv_timeout);
+
+	mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL);
+}
+
 void mgmt_exit(void)
 {
 	hci_mgmt_chan_unregister(&chan);

base-commit: 1081a6ef8f1e0661fd52eb3f878691b0b96cdff9
-- 
2.53.0

RE: Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3452 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1197220/

---Test result---

Test Summary:
CheckPatch                    PASS      1.17 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.23 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      31.31 seconds
CheckAllWarning               PASS      35.57 seconds
CheckSparse                   WARNING   38.55 seconds
BuildKernel32                 PASS      31.81 seconds
CheckKernelLLVM               PASS      44.42 seconds
TestRunnerSetup               PASS      748.20 seconds
TestRunner_l2cap-tester       FAIL      10.81 seconds
TestRunner_iso-tester         PASS      10.94 seconds
TestRunner_bnep-tester        PASS      3.22 seconds
TestRunner_mgmt-tester        PASS      88.64 seconds
TestRunner_rfcomm-tester      PASS      5.16 seconds
TestRunner_sco-tester         PASS      5.76 seconds
TestRunner_ioctl-tester       PASS      4.71 seconds
TestRunner_mesh-tester        PASS      5.57 seconds
TestRunner_smp-tester         PASS      4.37 seconds
TestRunner_userchan-tester    PASS      3.24 seconds
TestRunner_6lowpan-tester     PASS      4.49 seconds
IncrementalBuild              PASS      29.61 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==35==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b4eb88e33d0 at pc 0x561facb02e8e bp 0x7ffdc2595460 sp 0x7ffdc2595450
READ of size 4 at 0x7b4eb88e33d0 thread T0
    #0 0x561facb02e8d in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x561facb03b75 in timeout_callback src/shared/mainloop.c:270
    #2 0x561facb04aa6 in mainloop_run src/shared/mainloop.c:124
    #3 0x561facb073fa in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x561facb0c64b in tester_run src/shared/tester.c:1223
    #5 0x561faca3617d in main tools/l2cap-tester.c:3918
    #6 0x7f0eb98a8600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f0eb98a8717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x561faca3cc84 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16cc84) (BuildId: 91c9d49e9766c394468e27ffa29b05e7d348169f)

0x7b4eb88e33d0 is located 0 bytes inside of 40-byte region [0x7b4eb88e33d0,0x7b4eb88e33f8)
freed by thread T0 here:
    #0 0x7f0eba1e63ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x561facb0336a in timeout_destroy src/shared/mainloop.c:251

previously allocated by thread T0 here:
    #0 0x7f0eba1e760f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x561facaed2d5 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1032

---
Regards,
Linux Bluetooth