[PATCH 0/3] Bluetooth: Fixes for BR/EDR connection idle timeout configuration

[PATCH 0/3] Bluetooth: Fixes for BR/EDR connection idle timeout configuration

[Stefan Sørensen]

This series addresses issues with how Bluetooth BR/EDR connections handle
idle timeouts (entering Sniff mode) and exposes the timeout value to
userspace: 

1. Ensure the active mode timeout is correctly updated using
   mod_delayed_work(), preventing the timer from being ignored if
   already queued.
2. Apply the link policy to incoming ACL connections (previously only
   applied to outgoing), ensuring incoming connections can also enter
   idle modes.
3. Add idle_timeout to the configurable system parameters in the
   Management interface. This allows userspace to control when the
   Sniff mode is triggered, complementing the existing ability to
   control the Sniff parameters themselves.

Stefan Sørensen (3):
  Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
  Bluetooth: hci_conn: Set link_policy on incoming ACL connections
  Bluetooth: mgmt: Add idle_timeout to configurable system parameters

 net/bluetooth/hci_conn.c    |  3 ++-
 net/bluetooth/hci_sync.c    |  2 --
 net/bluetooth/mgmt_config.c | 21 +++++++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)

-- 
2.52.0

[PATCH 1/3] Bluetooth: hci_conn: use mod_delayed_work for active mode timeout

[Stefan Sørensen]

hci_conn_enter_active_mode() uses queue_delayed_work() with the
intention that the work will run after the given timeout. However,
queue_delayed_work() does nothing if the work is already queued, so
depending on the link policy we may end up putting the connection
into idle mode every hdev->idle_timeout ms.

Use mod_delayed_work() instead so the work is queued if not already
queued, and the timeout is updated otherwise.

Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
---
 net/bluetooth/hci_conn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5a4374ccf8e84..837038b5c5681 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2619,7 +2619,7 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 
 timer:
 	if (hdev->idle_timeout > 0)
-		queue_delayed_work(hdev->workqueue, &conn->idle_work,
+		mod_delayed_work(hdev->workqueue, &conn->idle_work,
 				   msecs_to_jiffies(hdev->idle_timeout));
 }
 
-- 
2.52.0

[PATCH 2/3] Bluetooth: hci_conn: Set link_policy on incoming ACL connections

[Stefan Sørensen]

The connection link policy is only set when establishing an outgoing
ACL connection causing connection idle modes not to be available on
incoming connections. Move the setting of the link policy to the
creation of the connection so all ACL connection will use the link
policy set on the HCI device.

Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
---
 net/bluetooth/hci_conn.c | 1 +
 net/bluetooth/hci_sync.c | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 837038b5c5681..fe73528ce2bf0 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1002,6 +1002,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
 	switch (type) {
 	case ACL_LINK:
 		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
+		conn->link_policy = hdev->link_policy;
 		conn->mtu = hdev->acl_mtu;
 		break;
 	case LE_LINK:
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index a9f5b1a68356e..3b620c6eed70c 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -6896,8 +6896,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
 
 	conn->attempt++;
 
-	conn->link_policy = hdev->link_policy;
-
 	memset(&cp, 0, sizeof(cp));
 	bacpy(&cp.bdaddr, &conn->dst);
 	cp.pscan_rep_mode = 0x02;
-- 
2.52.0

[PATCH 3/3] Bluetooth: mgmt: Add idle_timeout to configurable system parameters

[Stefan Sørensen]

While the configurable system parameters allow controlling the SNIFF
mode parameters, they do not include the idle_timeout parameter
responsible for enabling SNIFF mode.

Add the idle_timeout parameter to allow controlling the idle timeout
of BR/EDR connections.

Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
---
 net/bluetooth/mgmt_config.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/net/bluetooth/mgmt_config.c b/net/bluetooth/mgmt_config.c
index c4063d200c0a6..4ec6c008cb7e6 100644
--- a/net/bluetooth/mgmt_config.c
+++ b/net/bluetooth/mgmt_config.c
@@ -11,6 +11,12 @@
 #include "mgmt_util.h"
 #include "mgmt_config.h"
 
+#define HDEV_PARAM_U32(_param_name_) \
+	struct {\
+		struct mgmt_tlv_hdr entry; \
+		__le32 value; \
+	} __packed _param_name_
+
 #define HDEV_PARAM_U16(_param_name_) \
 	struct {\
 		struct mgmt_tlv_hdr entry; \
@@ -29,6 +35,12 @@
 		cpu_to_le16(hdev->_param_name_) \
 	}
 
+#define TLV_SET_U32(_param_code_, _param_name_) \
+	{ \
+		{ cpu_to_le32(_param_code_), sizeof(__u32) }, \
+		cpu_to_le32(hdev->_param_name_) \
+	}
+
 #define TLV_SET_U8(_param_code_, _param_name_) \
 	{ \
 		{ cpu_to_le16(_param_code_), sizeof(__u8) }, \
@@ -78,6 +90,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
 		HDEV_PARAM_U16(advmon_allowlist_duration);
 		HDEV_PARAM_U16(advmon_no_filter_duration);
 		HDEV_PARAM_U8(enable_advmon_interleave_scan);
+		HDEV_PARAM_U32(idle_timeout);
 	} __packed rp = {
 		TLV_SET_U16(0x0000, def_page_scan_type),
 		TLV_SET_U16(0x0001, def_page_scan_int),
@@ -111,6 +124,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
 		TLV_SET_U16(0x001d, advmon_allowlist_duration),
 		TLV_SET_U16(0x001e, advmon_no_filter_duration),
 		TLV_SET_U8(0x001f, enable_advmon_interleave_scan),
+		TLV_SET_U32(0x0020, idle_timeout),
 	};
 
 	bt_dev_dbg(hdev, "sock %p", sk);
@@ -122,6 +136,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
 }
 
 #define TO_TLV(x)		((struct mgmt_tlv *)(x))
+#define TLV_GET_LE32(tlv)	le32_to_cpu(*((__le32 *)(TO_TLV(tlv)->value)))
 #define TLV_GET_LE16(tlv)	le16_to_cpu(*((__le16 *)(TO_TLV(tlv)->value)))
 #define TLV_GET_U8(tlv)		(*((__u8 *)(TO_TLV(tlv)->value)))
 
@@ -191,6 +206,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
 		case 0x001f:
 			exp_type_len = sizeof(u8);
 			break;
+		case 0x0020:
+			exp_type_len = sizeof(u32);
+			break;
 		default:
 			exp_type_len = 0;
 			bt_dev_warn(hdev, "unsupported parameter %u", type);
@@ -314,6 +332,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
 		case 0x0001f:
 			hdev->enable_advmon_interleave_scan = TLV_GET_U8(buffer);
 			break;
+		case 0x00020:
+			hdev->idle_timeout = TLV_GET_LE32(buffer);
+			break;
 		default:
 			bt_dev_warn(hdev, "unsupported parameter %u", type);
 			break;
-- 
2.52.0

RE: Bluetooth: Fixes for BR/EDR connection idle timeout configuration

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3030 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1033698

---Test result---

Test Summary:
CheckPatch                    PENDING   0.36 seconds
GitLint                       PENDING   0.27 seconds
SubjectPrefix                 PASS      0.33 seconds
BuildKernel                   PASS      25.25 seconds
CheckAllWarning               PASS      27.92 seconds
CheckSparse                   WARNING   31.32 seconds
BuildKernel32                 PASS      25.31 seconds
TestRunnerSetup               PASS      551.71 seconds
TestRunner_l2cap-tester       PASS      25.41 seconds
TestRunner_iso-tester         PASS      80.01 seconds
TestRunner_bnep-tester        PASS      6.24 seconds
TestRunner_mgmt-tester        FAIL      115.42 seconds
TestRunner_rfcomm-tester      PASS      9.40 seconds
TestRunner_sco-tester         FAIL      14.50 seconds
TestRunner_ioctl-tester       PASS      10.44 seconds
TestRunner_mesh-tester        FAIL      11.56 seconds
TestRunner_smp-tester         PASS      8.57 seconds
TestRunner_userchan-tester    PASS      6.59 seconds
IncrementalBuild              PENDING   0.79 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/mgmt_config.c:127:17: warning: incorrect type in initializer (different base types)net/bluetooth/mgmt_config.c:127:17:    expected restricted __le16 [usertype] typenet/bluetooth/mgmt_config.c:127:17:    got restricted __le32 [usertype]
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 488 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.103 seconds
LL Privacy - Set Flags 1 (Add to RL)                 Failed       0.153 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.850 seconds
Mesh - Send cancel - 2                               Timed out    1.997 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH 3/3] Bluetooth: mgmt: Add idle_timeout to configurable system parameters

[Luiz Augusto von Dentz]

Hi Stefan,

On Tue, Dec 16, 2025 at 4:20 AM Stefan Sørensen <ssorensen@roku.com> wrote:
>
> While the configurable system parameters allow controlling the SNIFF
> mode parameters, they do not include the idle_timeout parameter
> responsible for enabling SNIFF mode.
>
> Add the idle_timeout parameter to allow controlling the idle timeout
> of BR/EDR connections.

While the implementation seem quite simple and elegant you will need
to first update the MGMT documentation:

https://github.com/bluez/bluez/blob/master/doc/mgmt.rst#read-default-system-configuration-since-118

And it is also a good idea to implement proper decoding for the new
option in btmon, but it doesn't seem we currently decode its
parameters:

https://github.com/bluez/bluez/blob/master/monitor/packet.c#L16577

I'm fine if you don't have free time to introduce decoding for the
existing opcodes we can leave it for later, but that would be great
for debugging purposes.

> Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
> ---
>  net/bluetooth/mgmt_config.c | 21 +++++++++++++++++++++
>  1 file changed, 21 insertions(+)
>
> diff --git a/net/bluetooth/mgmt_config.c b/net/bluetooth/mgmt_config.c
> index c4063d200c0a6..4ec6c008cb7e6 100644
> --- a/net/bluetooth/mgmt_config.c
> +++ b/net/bluetooth/mgmt_config.c
> @@ -11,6 +11,12 @@
>  #include "mgmt_util.h"
>  #include "mgmt_config.h"
>
> +#define HDEV_PARAM_U32(_param_name_) \
> +       struct {\
> +               struct mgmt_tlv_hdr entry; \
> +               __le32 value; \
> +       } __packed _param_name_
> +
>  #define HDEV_PARAM_U16(_param_name_) \
>         struct {\
>                 struct mgmt_tlv_hdr entry; \
> @@ -29,6 +35,12 @@
>                 cpu_to_le16(hdev->_param_name_) \
>         }
>
> +#define TLV_SET_U32(_param_code_, _param_name_) \
> +       { \
> +               { cpu_to_le32(_param_code_), sizeof(__u32) }, \
> +               cpu_to_le32(hdev->_param_name_) \
> +       }
> +
>  #define TLV_SET_U8(_param_code_, _param_name_) \
>         { \
>                 { cpu_to_le16(_param_code_), sizeof(__u8) }, \
> @@ -78,6 +90,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
>                 HDEV_PARAM_U16(advmon_allowlist_duration);
>                 HDEV_PARAM_U16(advmon_no_filter_duration);
>                 HDEV_PARAM_U8(enable_advmon_interleave_scan);
> +               HDEV_PARAM_U32(idle_timeout);
>         } __packed rp = {
>                 TLV_SET_U16(0x0000, def_page_scan_type),
>                 TLV_SET_U16(0x0001, def_page_scan_int),
> @@ -111,6 +124,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
>                 TLV_SET_U16(0x001d, advmon_allowlist_duration),
>                 TLV_SET_U16(0x001e, advmon_no_filter_duration),
>                 TLV_SET_U8(0x001f, enable_advmon_interleave_scan),
> +               TLV_SET_U32(0x0020, idle_timeout),
>         };
>
>         bt_dev_dbg(hdev, "sock %p", sk);
> @@ -122,6 +136,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
>  }
>
>  #define TO_TLV(x)              ((struct mgmt_tlv *)(x))
> +#define TLV_GET_LE32(tlv)      le32_to_cpu(*((__le32 *)(TO_TLV(tlv)->value)))
>  #define TLV_GET_LE16(tlv)      le16_to_cpu(*((__le16 *)(TO_TLV(tlv)->value)))
>  #define TLV_GET_U8(tlv)                (*((__u8 *)(TO_TLV(tlv)->value)))
>
> @@ -191,6 +206,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
>                 case 0x001f:
>                         exp_type_len = sizeof(u8);
>                         break;
> +               case 0x0020:
> +                       exp_type_len = sizeof(u32);
> +                       break;
>                 default:
>                         exp_type_len = 0;
>                         bt_dev_warn(hdev, "unsupported parameter %u", type);
> @@ -314,6 +332,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
>                 case 0x0001f:
>                         hdev->enable_advmon_interleave_scan = TLV_GET_U8(buffer);
>                         break;
> +               case 0x00020:
> +                       hdev->idle_timeout = TLV_GET_LE32(buffer);
> +                       break;
>                 default:
>                         bt_dev_warn(hdev, "unsupported parameter %u", type);
>                         break;
> --
> 2.52.0
>


-- 
Luiz Augusto von Dentz

Re: [PATCH 0/3] Bluetooth: Fixes for BR/EDR connection idle timeout configuration

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 16 Dec 2025 10:20:08 +0100 you wrote:
> This series addresses issues with how Bluetooth BR/EDR connections handle
> idle timeouts (entering Sniff mode) and exposes the timeout value to
> userspace:
> 
> 1. Ensure the active mode timeout is correctly updated using
>    mod_delayed_work(), preventing the timer from being ignored if
>    already queued.
> 2. Apply the link policy to incoming ACL connections (previously only
>    applied to outgoing), ensuring incoming connections can also enter
>    idle modes.
> 3. Add idle_timeout to the configurable system parameters in the
>    Management interface. This allows userspace to control when the
>    Sniff mode is triggered, complementing the existing ability to
>    control the Sniff parameters themselves.
> 
> [...]

Here is the summary with links:
  - [1/3] Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    (no matching commit)
  - [2/3] Bluetooth: hci_conn: Set link_policy on incoming ACL connections
    https://git.kernel.org/bluetooth/bluetooth-next/c/f7f2402b7807
  - [3/3] Bluetooth: mgmt: Add idle_timeout to configurable system parameters
    https://git.kernel.org/bluetooth/bluetooth-next/c/afa20d8099dd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html