[PATCH v3 0/2] Bluetooth: dial the address the peer is actually on air with

[Radek Podgorny]

An identity address only reaches a peer advertising an RPA if the
controller resolves it for us; where it cannot, the host has to dial the
peer's on-air address itself. v2 did that by keeping the RPA in conn->dst
when the controller will not translate, which Luiz asked for and which
holds for as long as the peer is still using that RPA.

It does not hold once a peer turns privacy off. hci_connect_le() swaps in
the cached RPA whenever the IRK has one, nothing ever clears that cache,
and a peer that stops sending RPAs stops producing the reports that would
refresh it. Before this series the conversion in __hci_conn_add() hid the
problem by turning the stale RPA back into the identity address; keeping
the RPA exposes it, and every connect attempt goes to an address the peer
has abandoned.

So patch 1 drops a cached RPA as soon as the peer is seen advertising its
identity address, and patch 2 is the v2 change on top of it. In that order
neither commit leaves the tree with the regression.

Not addressed here, by agreement: hci_conn_params_lookup() in
hci_le_create_conn_sync() is keyed by identity address and misses when
conn->dst holds an RPA, so the connection falls back to the default
intervals. That is the pre-14b06c3a88f7 behaviour and is better fixed on
top than folded in.

Measurements, hardware and limitations are unchanged from v2 and are
described in patch 2.

Changes in v3:
 - Add "forget a peer's RPA once it advertises its identity address"
   ahead of the address-selection change, after Luiz pointed out that a
   peer that disabled privacy should be dialled on its identity address
   rather than on a stale RPA.
 - Note the dependency between the two patches in patch 2's changelog.
 - Link to v2: https://lore.kernel.org/linux-bluetooth/20260908-for-upstream-le-connect-on-air-addr-v2-1-2ae9fa066ec8@xxxxxxxxxxx/

Changes in v2:
 - Move the address choice into __hci_conn_add() rather than translating
   at the create-connection command builders, as suggested by Luiz.
 - Drop the "record when an IRK's RPA was last seen" patch and the
   freshness window with it; hci_find_irk_by_rpa() already refreshes
   irk->rpa on every advertising report the host resolves.
 - Link to v1: https://lore.kernel.org/linux-bluetooth/20260908012048.3681904-2-radek@xxxxxxxxxxx/

Per Documentation/process/generated-content.rst: developed with the help
of the Claude coding assistant, as recorded in the Assisted-by trailers.
The prompts described the misdirected create-connection, the btmon
captures taken before and after, and the review feedback on v1 and v2; the
assistant was asked to locate where the dialled address is chosen, to
trace what invalidates a cached RPA, and to draft the changes and their
commit messages. The measurements, the hardware testing and the final
wording are the author's own.

Signed-off-by: Radek Podgorny <radek@xxxxxxxxxxx>
---
Radek Podgorny (2):
      Bluetooth: forget a peer's RPA once it advertises its identity address
      Bluetooth: put the peer's on-air address on air when we cannot resolve

 net/bluetooth/hci_conn.c  | 13 +++++++++++++
 net/bluetooth/hci_event.c |  9 +++++++++
 2 files changed, 22 insertions(+)
---
base-commit: 701ca71884b3d101fd25b7adbf972355056ef352
change-id: 20260908-for-upstream-le-connect-on-air-addr-a796ae625007

Best regards,
--  
Radek Podgorny <radek@xxxxxxxxxxx>