[PATCH v2] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[PATCH v2] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[Kevin Dewald]

Userspace is not told the parameters of LE connections: the Connection
Subrate event is only sent for LE Connection Rate Change, which needs
the Shorter Connection Interval feature, and nothing is sent when a
connection is established or updated with LE Connection Update
Complete. Applications that need the connection interval, e.g. to
estimate throughput or latency, have to read it from HCI traffic
instead.

Keep the connection rate parameters, which the event reports, in sync
when an LE connection is established and after each LE Connection
Update, with the interval converted to units of 0.125 ms, and send the
event then. As these do not report subrating, keep the subrate factor
and continuation number of the last connection rate change, or 1 and 0
if there was none. Load Connection Subrate then also compares new
parameters against the current ones rather than those of the last
connection rate change, and a failed connection rate change reports
the current parameters.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Kevin Dewald <kevin@simpleble.org>
---
Changes in v2:
- Keep the connection rate parameters in sync and send the event with
  mgmt_conn_subrate_notify() instead of a new function (Sashiko).
- Rebase on bluetooth-next 42b8c2d729.
- v1: https://lore.kernel.org/linux-bluetooth/20261030144106.75414-1-kevin@simpleble.org/

bluetoothd already registers the Connection Subrate event, and only logs
it for now. Once this is merged, I'll send the BlueZ side: it exposes
the parameters as properties of org.bluez.Bearer.LE1 (Interval, Latency,
SupervisionTimeout and Subrate), and documents the new cases of the
event in doc/mgmt-protocol.rst.

I reused the Connection Subrate event since it already carries the
interval, latency and supervision timeout. If you would rather keep it
for the connection rate procedure, I can add a separate event instead.

As the rate parameters now follow the connection, Load Connection
Subrate no longer requests a connection rate change for a connected
device whose current parameters already match the new ones. Before, it
did so until the first connection rate change.

Tested in test-runner with the functional tests of those BlueZ changes:
with this patch both hosts report the parameters once connected and
after a connection update, and without it neither does. The kernel
testers and the HoG tests, which also use Load Connection Subrate and
watch this event, pass as before. Only tested with the emulator.

The PHY in use could be reported the same way, but the kernel does not
know which PHY a connection starts on, so that would also need LE Read
PHY after connecting. I left it out for now.

 net/bluetooth/hci_event.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d05934fef4..6330f2da99 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5886,6 +5886,26 @@ static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
 	}
 }
 
+/* Keep the connection rate parameters, which the Connection Subrate event
+ * reports, in sync with the connection parameters and send the event. LE
+ * Connection Complete and LE Connection Update Complete don't report
+ * subrating, so keep the subrate factor and continuation number of the last
+ * connection rate change, if any.
+ */
+static void le_conn_update_rate(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	/* The connection interval is in units of 1.25 ms and the connection
+	 * rate interval in units of 0.125 ms.
+	 */
+	conn->le_rate_interval = conn->le_conn_interval * 10;
+	conn->le_rate_latency = conn->le_conn_latency;
+	conn->le_rate_supv_timeout = conn->le_supv_timeout;
+	if (!conn->le_subrate)
+		conn->le_subrate = 1;
+
+	mgmt_conn_subrate_notify(hdev, conn, 0x00);
+}
+
 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
 				 bdaddr_t *bdaddr, u8 bdaddr_type,
 				 bdaddr_t *local_rpa, u8 role, u16 handle,
@@ -6032,6 +6052,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
 	conn->le_conn_interval = interval;
 	conn->le_conn_latency = latency;
 	conn->le_supv_timeout = supervision_timeout;
+	le_conn_update_rate(hdev, conn);
 
 	hci_debugfs_create_conn(conn);
 	hci_conn_add_sysfs(conn);
@@ -6296,6 +6317,7 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
 		conn->le_conn_interval = le16_to_cpu(ev->interval);
 		conn->le_conn_latency = le16_to_cpu(ev->latency);
 		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
+		le_conn_update_rate(hdev, conn);
 	}
 
 	hci_dev_unlock(hdev);

base-commit: 42b8c2d729268a65a2d98064e8dc59ff53646b14
-- 
2.53.0

RE: [v2] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3452 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1199296/

---Test result---

Test Summary:
CheckPatch                    PASS      0.68 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.39 seconds
GitLint                       PASS      0.31 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      24.48 seconds
CheckAllWarning               PASS      28.60 seconds
CheckSparse                   WARNING   30.96 seconds
BuildKernel32                 PASS      28.29 seconds
CheckKernelLLVM               PASS      26.04 seconds
TestRunnerSetup               PASS      563.62 seconds
TestRunner_l2cap-tester       FAIL      12.19 seconds
TestRunner_iso-tester         PASS      10.88 seconds
TestRunner_bnep-tester        PASS      2.89 seconds
TestRunner_mgmt-tester        PASS      84.46 seconds
TestRunner_rfcomm-tester      PASS      4.12 seconds
TestRunner_sco-tester         PASS      5.20 seconds
TestRunner_ioctl-tester       PASS      4.31 seconds
TestRunner_mesh-tester        PASS      5.24 seconds
TestRunner_smp-tester         PASS      4.09 seconds
TestRunner_userchan-tester    PASS      3.10 seconds
TestRunner_6lowpan-tester     PASS      4.45 seconds
IncrementalBuild              PASS      24.66 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==35==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bcb0ebe33d0 at pc 0x55a2b2510e8e bp 0x7ffc6b145df0 sp 0x7ffc6b145de0
READ of size 4 at 0x7bcb0ebe33d0 thread T0
    #0 0x55a2b2510e8d in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x55a2b2511b75 in timeout_callback src/shared/mainloop.c:270
    #2 0x55a2b2512aa6 in mainloop_run src/shared/mainloop.c:124
    #3 0x55a2b25153fa in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x55a2b251a64b in tester_run src/shared/tester.c:1223
    #5 0x55a2b244417d in main tools/l2cap-tester.c:3918
    #6 0x7f8b0fad6600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f8b0fad6717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x55a2b244ac84 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16cc84) (BuildId: 91c9d49e9766c394468e27ffa29b05e7d348169f)

0x7bcb0ebe33d0 is located 0 bytes inside of 40-byte region [0x7bcb0ebe33d0,0x7bcb0ebe33f8)
freed by thread T0 here:
    #0 0x7f8b104143ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x55a2b251136a in timeout_destroy src/shared/mainloop.c:251

previously allocated by thread T0 here:
    #0 0x7f8b1041560f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x55a2b24fb2d5 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1047

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: MGMT: Send Connection Subrate on LE connection and update

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  2 Nov 2026 09:00:08 -0800 you wrote:
> Userspace is not told the parameters of LE connections: the Connection
> Subrate event is only sent for LE Connection Rate Change, which needs
> the Shorter Connection Interval feature, and nothing is sent when a
> connection is established or updated with LE Connection Update
> Complete. Applications that need the connection interval, e.g. to
> estimate throughput or latency, have to read it from HCI traffic
> instead.
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: MGMT: Send Connection Subrate on LE connection and update
    https://git.kernel.org/bluetooth/bluetooth-next/c/0c0c3d785643

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html