* [PATCH v2] Bluetooth: MGMT: Add management security level changed event
@ 2026-06-16 14:58 Frédéric Danis
2026-06-16 16:06 ` [v2] " bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Frédéric Danis @ 2026-06-16 14:58 UTC (permalink / raw)
To: linux-bluetooth
Add an event on device security level or encryption type change to
let user space know which level is currently in use.
Reset security level to 0 on disconnection so further connections
will correctly report security level changes.
This will be used for BlueZ qualification automation.
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
---
v1->v2:
- Add encryption type to the mgmt event
- Send event on security level or encryption type change
include/net/bluetooth/hci_core.h | 15 +++++++++++++--
include/net/bluetooth/mgmt.h | 11 +++++++++++
net/bluetooth/hci_conn.c | 8 ++++++++
net/bluetooth/hci_event.c | 20 ++++++++++++++++++--
net/bluetooth/mgmt.c | 20 ++++++++++++++++++++
5 files changed, 70 insertions(+), 4 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7e15da47fe3a..2920229c7f0b 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2177,6 +2177,8 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
conn->security_cfm_cb(conn, status);
}
+void mgmt_security_level_changed(struct hci_conn *conn);
+
static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
{
struct hci_cb *cb;
@@ -2199,11 +2201,20 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
encrypt = 0x01;
if (!status) {
- if (conn->sec_level == BT_SECURITY_SDP)
+ bool sec_level_changed = false;
+
+ if (conn->sec_level == BT_SECURITY_SDP) {
conn->sec_level = BT_SECURITY_LOW;
+ sec_level_changed = true;
+ }
- if (conn->pending_sec_level > conn->sec_level)
+ if (conn->pending_sec_level > conn->sec_level) {
conn->sec_level = conn->pending_sec_level;
+ sec_level_changed = true;
+ }
+
+ if (sec_level_changed)
+ mgmt_security_level_changed(conn);
}
mutex_lock(&hci_cb_list_lock);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 08daed7a96d5..69e0f3503e79 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -1192,3 +1192,14 @@ struct mgmt_ev_mesh_device_found {
struct mgmt_ev_mesh_pkt_cmplt {
__u8 handle;
} __packed;
+
+#define MGMT_CONN_SEC_ENCRYPT_NONE 0x00
+#define MGMT_CONN_SEC_ENCRYPT_E0 0x01
+#define MGMT_CONN_SEC_ENCRYPT_AES_CCM 0x02
+
+#define MGMT_EV_SECURITY_LEVEL_CHANGED 0x0033
+struct mgmt_ev_security_level_changed {
+ struct mgmt_addr_info addr;
+ __u8 level;
+ __u8 enc_type;
+} __packed;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index c335372e4062..c9fb134c8891 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1200,6 +1200,11 @@ static void hci_conn_unlink(struct hci_conn *conn)
if (!conn->parent) {
struct hci_link *link, *t;
+ conn->sec_level = BT_SECURITY_SDP;
+ clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ mgmt_security_level_changed(conn);
+
list_for_each_entry_safe(link, t, &conn->link_list, list) {
struct hci_conn *child = link->conn;
@@ -1502,6 +1507,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
}
conn->sec_level = BT_SECURITY_LOW;
+ mgmt_security_level_changed(conn);
conn->conn_timeout = conn_timeout;
conn->le_adv_phy = phy;
conn->le_adv_sec_phy = sec_phy;
@@ -1729,6 +1735,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
conn->state = BT_CONNECT;
set_bit(HCI_CONN_SCANNING, &conn->flags);
conn->sec_level = BT_SECURITY_LOW;
+ mgmt_security_level_changed(conn);
conn->pending_sec_level = sec_level;
conn->conn_timeout = conn_timeout;
conn->conn_reason = conn_reason;
@@ -1777,6 +1784,7 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
int err;
acl->sec_level = BT_SECURITY_LOW;
+ mgmt_security_level_changed(acl);
acl->pending_sec_level = sec_level;
acl->auth_type = auth_type;
acl->conn_timeout = timeout;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b6d963ce26d0..15086780b766 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -762,6 +762,7 @@ static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
status = HCI_ERROR_AUTH_FAILURE;
clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ mgmt_security_level_changed(conn);
}
/* Update the key encryption size with the connection one */
@@ -3184,6 +3185,8 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
}
if (!status) {
+ bool encrypt_change = false;
+
status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
if (status)
goto done;
@@ -3206,8 +3209,10 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
if (test_bit(HCI_AUTH, &hdev->flags))
set_bit(HCI_CONN_AUTH, &conn->flags);
- if (test_bit(HCI_ENCRYPT, &hdev->flags))
+ if (test_bit(HCI_ENCRYPT, &hdev->flags)) {
set_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ encrypt_change = true;
+ }
/* "Link key request" completed ahead of "connect request" completes */
if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
@@ -3217,11 +3222,15 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
key = hci_find_link_key(hdev, &ev->bdaddr);
if (key) {
set_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ encrypt_change = true;
hci_read_enc_key_size(hdev, conn);
hci_encrypt_cfm(conn, ev->status);
}
}
+ if (encrypt_change)
+ mgmt_security_level_changed(conn);
+
/* Get remote features */
if (conn->type == ACL_LINK) {
struct hci_cp_read_remote_features cp;
@@ -3507,6 +3516,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
set_bit(HCI_CONN_AUTH, &conn->flags);
conn->sec_level = conn->pending_sec_level;
+ mgmt_security_level_changed(conn);
} else {
if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
@@ -3622,9 +3632,12 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
conn->type == LE_LINK)
set_bit(HCI_CONN_AES_CCM, &conn->flags);
+
+ mgmt_security_level_changed(conn);
} else {
clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ mgmt_security_level_changed(conn);
}
}
@@ -5215,8 +5228,10 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
if (conn->type != LE_LINK)
goto unlock;
- if (!ev->status)
+ if (!ev->status) {
conn->sec_level = conn->pending_sec_level;
+ mgmt_security_level_changed(conn);
+ }
clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
@@ -5847,6 +5862,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
mgmt_device_connected(hdev, conn, NULL, 0);
conn->sec_level = BT_SECURITY_LOW;
+ mgmt_security_level_changed(conn);
conn->state = BT_CONFIG;
/* Store current advertising instance as connection advertising instance
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index dc55763f9e58..b02181f945d8 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -177,6 +177,7 @@ static const u16 mgmt_events[] = {
MGMT_EV_CONTROLLER_RESUME,
MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
MGMT_EV_ADV_MONITOR_DEVICE_LOST,
+ MGMT_EV_SECURITY_LEVEL_CHANGED,
};
static const u16 mgmt_untrusted_commands[] = {
@@ -10534,6 +10535,25 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
}
+void mgmt_security_level_changed(struct hci_conn *conn)
+{
+ struct mgmt_ev_security_level_changed ev;
+
+ bacpy(&ev.addr.bdaddr, &conn->dst);
+ ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
+ ev.level = conn->sec_level;
+
+ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ ev.enc_type = MGMT_CONN_SEC_ENCRYPT_NONE;
+ else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
+ ev.enc_type = MGMT_CONN_SEC_ENCRYPT_AES_CCM;
+ else
+ ev.enc_type = MGMT_CONN_SEC_ENCRYPT_E0;
+
+ mgmt_event(MGMT_EV_SECURITY_LEVEL_CHANGED, conn->hdev, &ev, sizeof(ev),
+ NULL);
+}
+
void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
u8 addr_type, s8 rssi, u8 *name, u8 name_len)
{
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [v2] Bluetooth: MGMT: Add management security level changed event
2026-06-16 14:58 [PATCH v2] Bluetooth: MGMT: Add management security level changed event Frédéric Danis
@ 2026-06-16 16:06 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2026-06-16 16:06 UTC (permalink / raw)
To: linux-bluetooth, frederic.danis
[-- Attachment #1: Type: text/plain, Size: 2469 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1112403
---Test result---
Test Summary:
CheckPatch PASS 1.45 seconds
VerifyFixes PASS 0.07 seconds
VerifySignedoff PASS 0.07 seconds
GitLint PASS 0.20 seconds
SubjectPrefix PASS 0.06 seconds
BuildKernel PASS 26.77 seconds
CheckAllWarning PASS 29.14 seconds
CheckSparse PASS 27.75 seconds
BuildKernel32 PASS 25.71 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 576.60 seconds
TestRunner_l2cap-tester PASS 58.98 seconds
TestRunner_iso-tester PASS 78.50 seconds
TestRunner_bnep-tester PASS 18.77 seconds
TestRunner_mgmt-tester FAIL 208.08 seconds
TestRunner_rfcomm-tester PASS 25.39 seconds
TestRunner_sco-tester PASS 32.28 seconds
TestRunner_ioctl-tester PASS 25.58 seconds
TestRunner_mesh-tester FAIL 24.95 seconds
TestRunner_smp-tester PASS 23.13 seconds
TestRunner_userchan-tester PASS 19.70 seconds
TestRunner_6lowpan-tester PASS 22.49 seconds
IncrementalBuild PASS 24.70 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 488 (98.8%), Failed: 2, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.245 seconds
LL Privacy - Unpair 1 Timed out 1.853 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 1.826 seconds
Mesh - Send cancel - 2 Timed out 1.992 seconds
https://github.com/bluez/bluetooth-next/pull/320
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-16 16:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-16 14:58 [PATCH v2] Bluetooth: MGMT: Add management security level changed event Frédéric Danis
2026-06-16 16:06 ` [v2] " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox