The mutex may not have been initialized when the
disconnected callback was called which would attempt to use it,
if bt_bap_scan_delegator_register was not called first.
Changed to use SYS_INIT to initialize the mutex and k_work.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The mutex may not have been initialized when the
disconnected callback was called which would attempt to use it,
if bt_mcs_init was not called first.
Changed to use SYS_INIT to initialize the mutex.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Rename the `configured` and `qos_set` callbacks of
`struct bt_bap_stream_ops` to `codec_configured` and `qos_configured`
respectively, so that the names align with the ASE state machine names
defined by the ASCS specification.
All in-tree users (host implementation, shell, samples and tests) have
been updated accordingly, including the local callback function names
that mirror the operation names.
Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The function accessed the instance without taking the mutex.
This also fixes the reporting time in the log from ticks to ms.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Header file include/zephyr/sys_clock.h is deprecated and will be removed
someday. Update the whole file tree to include zephyr/sys/clock.h
straight instead of zephyr/sys_clock.h.
This change was made running the sed shell command below:
$ sed -i 's/zephyr\/sys_clock\.h/zephyr\/sys\/clock\.h/' \
`grep -rsl "zephyr/sys_clock\.h" subsys/bluetooth/`
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
(cte_types & A) || (cte_types & B) is equivalent to
cte_types & (A | B). Collapse the BT_HCI_LE_AOD_CTE_RSP_1US / _2US test
into a single masked check. No change in behavior.
Signed-off-by: Flavio Ceolin <flavio@hubble.com>
(keys->flags & A) || (keys->flags & B) is equivalent to
keys->flags & (A | B). Collapse the BT_KEYS_OOB / BT_KEYS_SC test into a
single masked check.
Signed-off-by: Flavio Ceolin <flavio@hubble.com>
Some compilers would give the following warning:
subsys/bluetooth/audio/bap_broadcast_source.c:513:9:
warning: 'pd' may be used uninitialized [-Wmaybe-uninitialized]
513 | net_buf_simple_add_le24(buf, pd);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Even though the assignment `subgroup_count = 0U;`
and later check `if (subgroup_count == 0U) {` would
ensure that `pd = stream->ep->qos.pd;` is always performed.
Add a initialization of the variable to avoid any
warnings.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The encrypted Solicitation PDU is defined by Mesh Protocol 1.1.1
section 6.9.1 as a fixed 17-octet Network PDU (CTL=1, TTL=0, empty
TransportPDU, 8-octet NetMIC).
The mesh scan callback in adv.c restores its snapshot of the
advertising buffer before dispatching, so buf->len passed into
bt_mesh_sol_recv() may still cover trailing AD structures beyond the
Solicitation Service Data.
Trim buf->len to the expected 17 octets after consuming the
Solicitation Service Data Identification Type byte, and drop the PDU
early if fewer octets remain. This aligns the input handed to
sol_pdu_decrypt() with the specification.
The outer parsing loop is unaffected because the scan callback takes
its own net_buf_simple_save/restore snapshot around the dispatch.
Gated by CONFIG_BT_MESH_OD_PRIV_PROXY_SRV.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
If the stream has an endpoint associated with it from calling
bt_bap_stream_config but where this may have been rejected
by the peer, then the stream->ep will remain, but where the
state of the endpoint will be idle.
bt_bap_stream_release can be used to resetting this and
setting stream->ep to NULL.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
In the case that the function is called for e.g. a central and
CONFIG_BT_BAP_UNICAST_CLIENT=n, then it should not assert, as that
is possibly if the build supports both central and peripheral, but
only has CONFIG_BT_BAP_UNICAST_SERVER=y.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The release and disable operations did not use the function,
but instead had their own switches. Changes to use the
appropriate function.
Additionally modified some of the other calls so that they
appear more similar, and avoid unncessary `struct bt_bap_ep *ep`
variables but also add `struct bt_conn *conn;` variables to
avoid doing `stream->conn` more often than what is needed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Three argument parsers in bt.c silently ignored invalid or unknown
arguments, allowing the underlying operation to proceed as if no
bad input was given.
cmd_adv_start: the two keyword checks ("timeout", "num-events") were
written as independent if-blocks. An unknown argument (including
"--help") falls through both checks without error and advertising
starts. Convert to if/else-if/else and change fail_show_help to return
SHELL_CMD_HELP_PRINTED, consistent with the rest of the file.
cmd_per_adv_param: the expression (argc > 3 && !strcmp(argv[3],
"tx-power")) silently discards any other value for the fourth
argument. Split the condition so that a non-empty argv[3] that is not
"tx-power" is rejected with help.
cmd_fal_connect: the if/else-if chain for "on"/"off" had no else
branch; an unrecognised action fell through and returned 0 as if it
succeeded. Add an else branch that shows help and returns
SHELL_CMD_HELP_PRINTED.
Assisted-by: Claude:claude-sonnet-4.6
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If we fail to add any objects, then MCS would not work
correctly and would cause NULL pointer accesses thus
causing fatal errors.
Changed the error checking to asserts to catch this in
a more direct manner that is easier to debug, rather
than leaving MCS wrongly initiated and hope for no
runtime fatal errors later on.
Changed the check from media_proxy_pl_register to an assert
as it will always return 0 with the current implementation.
This is a workaround to handle the fatal error and instead
allow invalid behavior in MCS if there is a failure. A proper
fix should be done, but at the time of this commit, there are
another pending change that significantly refactors all this
code, and fixing the real issue before the refactor would
result in a massive re-write.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If the is_cap boolean is set, the group was not automatically
deleted when all the streams were relased. CAP instead had
a different way of deleting the group, but in the case of
an error in CAP unicast start, that group was not deletable.
This change make it so that the user can always delete the unicast
group, as BAP or CAP, by releasing all the streams, regardless of
what procedures have failed or succeeded, or even been cancelled.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The `l2cap_br_retransmit_i_frames()` function was using
`atomic_test_and_set_bit()` to check and set the
`L2CAP_FLAG_RET_I_FRAMES` flag simultaneously. This caused the flag
to be set even when the outstanding PDU queue was empty, leading to
a state where the flag remained set without any frames to retransmit.
Fix the issue by only setting the flag `L2CAP_FLAG_RET_I_FRAMES`
after marking frames for retransmission, and only if there are
actually outstanding PDUs in the queue.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Currently, the VOCS client subscribes to characteristics by hardcoding
the CCC handle offset to attr->handle + 2. While common, this layout
is not strictly guaranteed by the Bluetooth specification and can fail
if a server structures its GATT table differently.
This commit updates the characteristic discovery callback to use the
CONFIG_BT_GATT_AUTO_DISCOVER_CCC feature to dynamically locate the CCC.
To support concurrent CCC discoveries safely, dedicated discovery
parameter structures are added to the VOCS client instance. This
prevents in-flight characteristic discoveries from clobbering each
other's memory state. Additionally, the auto-discovery boundary is
corrected to use the end of the service, rather than prematurely
shrinking to the characteristic value handle.
The hardcoded fallback and conditional compilation directives have
been removed, as VOCS inherently relies on CCC auto-discovery being
enabled via Kconfig.
Assisted-by: Gemini:gemini-3.1-pro
Fixeszephyrproject-rtos/zephyr#81132
Signed-off-by: Rupesh Kadam <rupesh.kadam1510@gmail.com>
The state->pa_sync was not properly assigned a few places, causing
invalid behavior in the shell.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When calling bt_le_per_adv_sync_get_info we should not provide
information from the PA sync object if it is not longer valid.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove the _transport_type field from bt_map_mce_mas, bt_map_mce_mns,
bt_map_mse_mas, and bt_map_mse_mns structures.
Replace all usages of `_transport_type` with `goep.v2` to determine
whether the active transport is L2CAP (v2) or RFCOMM (v1), since this
information is already encoded in the GOEP instance after
BT_GOEP_INIT_V1/V2.
Signed-off-by: Can Wang <can.wang@nxp.com>
Return -ENODATA when the End of Body header is missing.
Previously, the code did not return an error when End of Body
was absent, which could cause the caller to treat the message as
valid. Fix this by returning `-ENODATA` in this case.
Signed-off-by: Can Wang <can.wang@nxp.com>
Add state validation check in the L2CAP BR/EDR receive path to ensure
channels are in a valid connected state before processing incoming
data.
The change adds a check after the fixed channel validation to verify
that the channel state is at least `BT_L2CAP_CONNECTED` before
proceeding with data reception. If the channel is in an earlier state
(`CONNECTING` or `DISCONNECTED`), an error is logged and the packet is
dropped.
It prevents potential issues from processing data on channels that
are not yet fully established or are in the process of being torn down,
improving the robustness of the L2CAP receive path.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Refactor the fixed channel accept functions to use channel state
for direct check if the channel is available instead of checking
`conn` field of channel. And also refactor the fixed channel
accept functions to use connection index for direct lookup instead
of iterating through the pool arrays.
The changes affect the L2CAP BR signaling channel, connectionless
channel, and SMP BR channel accept functions.
The functions now check if the channel is in the `DISCONNECTED`
state before accepting a new connection, returning `-EBUSY` if the
channel is not idle. This ensures proper channel state validation
and prevents reuse of channels that are still in use.
Additionally, instead of searching through the entire pool to find
an available channel context, the code now uses `bt_conn_index()` to
directly access the corresponding entry in the pool array.
The L2CAP BR fixed channel connection now also sets the channel
state to CONNECTING, ensuring proper state transitions.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add proper state management to Bluetooth Classic L2CAP fixed channel
connection by setting the channel state to `CONNECTED` before invoking
the connected callback.
The change ensures that fixed channels follow the same state
transition pattern as other L2CAP channel types. When a fixed channel
is connected, the state is now explicitly set to `BT_L2CAP_CONNECTED`
before calling the channel's connected callback.
The changes ensure the channel state accurately reflects its lifecycle
status.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Optimize the L2CAP BR/EDR dynamic CID allocation by using a static
counter to track the last allocated CID instead of always starting
from the beginning of the range.
The change introduces a br_cid_next array that maintains the position
of the next CID to allocate for each connection. The allocation now
searches from the last allocated position through the range, wrapping
around if needed. This reduces the search time for available CIDs in
scenarios with multiple active channels by avoiding repeated scans of
already-allocated CIDs at the start of the range.
Additionally, this modification has the advantage of preventing a
recently disconnected CID from being immediately reassigned to a new
channel. This avoids data from the channel disconnection process being
sent to the newly assigned channel.
The allocation still validates that CIDs are not in use by checking
against bt_l2cap_br_lookup_rx_cid() before assignment, maintaining the
same correctness guarantees as the previous implementation.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The connection pointer is already cleared by the L2CAP layer when the
channel is disconnected, so there's no need to manually set it to NULL
in the AVCTP disconnect callback.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The connection pointer is already cleared by the L2CAP layer when the
channel is disconnected, so there's no need to manually set it to NULL
in the AVDTP disconnect callback.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Refactor SDU (Service Data Unit) length tracking in Bluetooth Classic
L2CAP to use closure-based storage instead of channel state variables.
The change introduces a new l2cap_br_closure structure that extends
the base closure with an sdu_len field, allowing SDU length to be
stored per-buffer rather than in the channel structure. This eliminates
the need for _sdu_total_len tracking in both bt_l2cap_br_chan and
bt_l2cap_br_window structures.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add doxygen warnings to PBAP authentication helper functions to inform
users that PBAP v1.x uses MD5 for authentication, which is
cryptographically weak and provides limited security.
Add the log warnings to the function. The warning Log message will be
printed when the function is being called in the running time mode.
Also add a building warning if the `CONFIG_BT_PBAP` is enabled.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The HCI Set Extended Advertising Parameters command carries an
Advertising_TX_Power field, but Zephyr hardcoded it to
BT_HCI_LE_ADV_TX_POWER_NO_PREF, giving applications no way to
request a specific TX power for an extended advertising set.
Add an int8_t tx_power field to struct bt_le_adv_param together
with a new BT_LE_ADV_OPT_TX_POWER options bit. When the bit is set,
the tx_power value is passed to the controller via
le_ext_adv_param_set(). The controller selects the closest supported
level and reports the actual value back via bt_le_ext_adv_info.tx_power.
Existing code that does not set BT_LE_ADV_OPT_TX_POWER is unaffected;
the controller continues to choose the TX power freely.
Assisted-by: Augment:claude-sonnet-4.6
Signed-off-by: Sharon Lin <slin@atmosic.com>
Replace memcmp() with mbedtls_ct_memcmp() when verifying authentication
response digests to prevent timing attacks. The standard memcmp()
function may leak information about the digest through timing side
channels, allowing attackers to potentially recover the digest
byte-by-byte.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The per-adv-sync shell commands store the selected index for the
per_adv_syncs array. The select command validated and listed adv_sets
instead, so ARRAY_SIZE could select past per_adv_syncs or show unrelated
advertiser entries.
Return immediately when per-adv-sync transfer gets an out-of-range index.
Parse the optional index with shell_strtoul() so invalid input does not
fall through to the array access.
Signed-off-by: Old Ding <ai.neo.ae86@gmail.com>
The shell commands parse zero-based indexes and then use them directly as
array subscripts. Reject ARRAY_SIZE as well as larger values so the upper
bound cannot address one element past the array.
Signed-off-by: Old Ding <ai.neo.ae86@gmail.com>
Per documentation, the `module-str` variable used by the logging Kconfig
template should NOT contain strings, but instead the bare (unquoted)
name of the module.
Clean up Kconfig files in the Bluetooth subsystem which used quotes
where they shouldn't have, resulting in inconsistent option prompts
compared to all other logging options in tree.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
If notifications sent in the notify_cb function (system wq)
fails due to e.g. buffer issues, they are now retried, so that
it is ensure that the notification is sent.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Reorder the track_1_x and track_2_x entries so the longer track
set comes first and the segment navigation flow matches the
expected test sequence. Also change segment durations to be one
third of the track duration, so the segment layout scales with
the track data.
Signed-off-by: Alex Ciascai <alexandru.ciascai@nordicsemi.no>
Expose a new le_param_update_rejected callback in bt_conn_cb that is
invoked when a connection parameter update request is rejected, covering
both the HCI Connection Parameter Request (CPR) procedure and the L2CAP
Connection Parameter Update Procedure (CPUP) fallback.
The feature is gated by the new Kconfig option BT_USER_CONN_PARAM_REJECT.
When enabled, le_conn_update_complete() reports a rejection only for
application-initiated updates that finally failed, i.e. not while a
host-initiated (auto) update is still being retried and not for the
auto-initiated updates themselves, matching the documented scope of the
callback. The L2CAP fallback path reports a rejection using the synthetic
BT_HCI_ERR_L2CAP_CPUP_REJECTED (0xFF) code so applications can distinguish
an L2CAP fallback rejection from a real HCI CPR rejection error code.
As part of this, le_param_updated() is no longer called when an update
fails (previously it was called unconditionally, reporting the unchanged
parameters with no error indication). This behaviour change is documented
in the migration guide.
Add release note and migration guide entries and a bsim test under
tests/bsim/bluetooth/host/misc/conn_param_update_reject that exercises both
the application-initiated rejection path and that a rejected host-initiated
(auto) update does not trigger the callback.
Signed-off-by: Sharon Lin <slin@atmosic.com>
Replace nested MIN/MAX macro calls with the min3/max3 APIs which are
safer (evaluate arguments only once) and cleaner.
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Add a new API bt_le_per_adv_update_did() that sends the
LE Set Periodic Advertising Data HCI command with operation
set to 0x04 (Unchanged Data). This instructs the controller
to update only the Advertising Data Identifier (DID) in the
ADI field without modifying the advertising data payload.
This is useful when the application wants to signal to
scanners that the periodic advertising train has new
information available (via DID change) without actually
changing the data content.
Also add a corresponding shell command 'per-adv-update-did'
for testing purposes.
Signed-off-by: Zihao Gao <gaozihao@xiaomi.com>
Assisted-by: Kiro:claude-opus-4.6
The text states that the minimum is 1, but it is possible to
set the value to 0 even when CONFIG_BT_SMP=y.
This commit changes this so that the option and text matches.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove Source_Address_Type from the receive state matching criteria in
find_recv_state_by_sink_fields_cb(). In privacy scenarios, a Broadcast
Source may advertise using a resolvable private address (RPA) or an
address type that differs from what the BASS client originally wrote.
The previous address type comparison caused the lookup to fail, preventing
the sink from ever attempting PA synchronization with a valid source.
Per BASS 3.1.1.4, the server identifies the Broadcast Source to
synchronize with by comparing Adv_SID (from ADV_EXT_IND) and
Broadcast_ID (from AUX_ADV_IND) only. Address type is not part of
the identification criteria.
Signed-off-by: Yago Fontoura do Rosario <yafo@demant.com>
Change the BAP roles to require
BT_AUDIO_CODEC_CFG_MAX_DATA_SIZE to be at least 19.
This is the minimal amount of cfg data required to support LC3,
which is mandated by BAP.
Adding this requirement should not really affect any existing
applications, given that it was the default.
Adding this requirement allows us to remove a bunch of guards
since we can rely on Kconfig to ensure it's non-0.
BT_AUDIO_CODEC_CFG_MAX_DATA_SIZE may still be set to a lower value
in case the audio API is used without BAP.
ASCS can technically be used without BAP, but currently it is very
tied to BAP and thus the requirement was also added for ASCS until
the BAP depdenency is changed in the future.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
