The HCI LE Start Encryption command parameters for `rand` and `ediv`
should be byte arrays, not integer types, to match the HCI specification
and avoid unaligned structure member access warnings.
- Change `rand` from uint64_t to uint8_t[8]
- Change `ediv` from uint16_t to uint8_t[2]
- Update memcpy calls to remove unnecessary address-of operators
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace the two-line pattern:
net_buf_unref(buf);
buf = NULL;
with net_buf_drop(&buf) which performs both operations
atomically in a single step.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
In bt_set_adv_param() and bt_br_init(), response buffers were
unreferenced but the pointer left live for significant amounts of
subsequent code. Use net_buf_drop() to make the intent explicit and
guard against accidental use-after-free.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(buf);
buf = NULL;
with net_buf_drop(&buf) which performs both operations
atomically in a single step.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(buf);
buf = NULL;
with net_buf_drop(&buf) which performs both operations
atomically in a single step.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
g_pbap_app->tx_buf is a global struct member. On the error paths
the buffer was unconditionally unreferenced and cleared to NULL via
two separate statements with intervening code. Replace with
net_buf_drop() to combine both into a single atomic step.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(br_chan->_sdu);
br_chan->_sdu = NULL;
with net_buf_drop(&br_chan->_sdu) which performs both operations
atomically in a single step.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the if-guarded two-line pattern:
if (avctp->reassembly_buf != NULL) {
net_buf_unref(avctp->reassembly_buf);
avctp->reassembly_buf = NULL;
}
with net_buf_drop(&avctp->reassembly_buf) which performs both operations
atomically in a single step. The guard is unnecessary when there is no
other logic conditional on the pointer being non-NULL, because
net_buf_drop() handles a NULL pointer internally. Where the if-body
contains additional logging, the guard is kept.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the if-guarded two-line pattern:
if (session->reasm_buf != NULL) {
net_buf_unref(session->reasm_buf);
session->reasm_buf = NULL;
}
with net_buf_drop(&session->reasm_buf) which performs both operations
atomically in a single step. The guard is unnecessary when there is no
other logic conditional on the pointer being non-NULL, because
net_buf_drop() handles a NULL pointer internally. Where the if-body
contains additional logging, the guard is kept.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the if-guarded two-line pattern:
if (session->rec_buf != NULL) {
net_buf_unref(session->rec_buf);
session->rec_buf = NULL;
}
with net_buf_drop(&session->rec_buf) which performs both operations
atomically in a single step. The guard is unnecessary because
net_buf_drop() handles a NULL pointer internally.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(*buf);
*buf = NULL;
with net_buf_drop(buf) which performs both operations atomically in a
single step.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the if-guarded two-line pattern:
if (*buf) {
net_buf_unref(*buf);
*buf = NULL;
}
with net_buf_drop(buf) which performs both operations atomically in a
single step. The guard is unnecessary because net_buf_drop() handles a
NULL pointer internally.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(buf);
buf = NULL;
(and equivalent if-guarded variants) with net_buf_drop(&buf) which
performs both operations atomically in a single step. The guard is
unnecessary because net_buf_drop() handles a NULL pointer internally.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the two-line pattern:
net_buf_unref(buf);
buf = NULL;
with net_buf_drop(&buf) which performs both operations
atomically in a single step.
Assisted-by: GitHub Copilot:claude-sonnet-4.6
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
When the peer disconnects mid-transfer, the bt_att and bt_att_chan are
freed (att_chan_detach()/att_reset(), then bt_att_released()) while a
deferred unenhanced-ATT "sent" callback is still queued on the system
workqueue: the ATT TX buffer destroy work runs att_on_sent_cb() ->
bt_att_sent(), which dereferences the freed context and bus-faults in
sys_slist_get(&att->reqs).
att_on_sent_cb() already guards against a detached bearer, but it does
so by dereferencing meta->att_chan, which by then is a dangling pointer
(and faults once the channel slab slot has been reused).
Null any pending ATT TX metadata referencing the channel in
bt_att_released(), before the channel is freed, so the guard drops the
deferred callback instead of dereferencing freed memory. Teardown and
the destroy work both run on the cooperative system workqueue, so this
is serialized and needs no lock.
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Hayden Ball <hayden@playerdata.com>
Add shell commands to retrieve and clear LPN friendship timing
statistics. Available as mesh stat lpn_get and mesh stat lpn_clear
when CONFIG_BT_MESH_LOW_POWER is enabled. Rename existing frame
statistic commands to mesh stat adv_get and mesh stat adv_clear.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
Add timestamp-based measurement of LPN friendship timing parameters
(ReceiveDelay and ReceiveWindow) to the statistic module. Timestamps
are captured at poll TX end, scanner enable, and response RX/timeout
using k_uptime_ticks(). Measured values are stored in microseconds.
Instrument the LPN state machine in lpn.c to call the statistic
update functions at each protocol event.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
Most HCI drivers have never handled the return value from the
driver-to-host receive path in any way, and they haven't really needed to
either since the buffer was always consumed regardless of success or
failure.
To be aligned with Zephyr coding guidelines without having to add
minimal value code to every driver, change bt_hci_recv() to return void
instead. A new bt_hci_recv_err() API is also added for any use case where
access to the error is needed.
There's also a related semantic change to the recv callback (passed to
bt_hci_open()) in that it's now expected to *not* consume the buffer in
case of error. There was only a single place in the host that needed an
update for this, while e.g. HCI raw always returned success.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
There's no point in having driver specific data structs if the only thing
they contain is the common data struct. Just declare the common data struct
directly as dev->data.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Now that we have a common data struct, we can take advantage of it and
move the recv callback into it. This way the common layer takes care of
assigning, dispatching and clearing the callback. Drivers now have to use
the new bt_hci_recv() API to pass data to the layer above them (typically
a host stack). Additionally, the drivers no longer get a recv parameter as
part of their open() callback, since that's all handled by the common
layer.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Make these static (no need to export them) and also name them in a way that
doesn't class with the HCI driver API prefix.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Replace the local PDU access macros in net.c with static helper
functions.
Using functions avoids preprocessor namespace pollution from common
macro names such as SRC while preserving the same behavior. The
functions are local to net.c and are expected to be inlined by the
compiler, resulting in no functional change.
Fixes#109401
Signed-off-by: Gobi M <gobi@aerlync.com>
subnet_keys_destroy() guarded the destroy of keys->priv_beacon with
#if defined(CONFIG_BT_MESH_V1d1), while net_keys_create() guards the
matching import with #if defined(CONFIG_BT_MESH_PRIV_BEACONS).
Commit 981c79b7ce ("Bluetooth: Mesh: Drop explicit support for
Bluetooth Mesh 1.0.1") removed the CONFIG_BT_MESH_V1d1 Kconfig but
left this stray reference behind. With V1d1 gone, the destroy branch
is permanently dead code, so every successful net_keys_create() leaks
one PSA key slot.
In a long-running test that repeatedly provisions and resets a node
(no persistent settings, in-RAM CDB only), the leak accumulates one
PSA volatile-key slot per provisioning round. With the default
CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=16, bt_mesh_private_beacon_key()
fails after ~12 rounds with:
<err> bt_mesh_net_keys: Unable to generate private beacon key
<err> bt_mesh_net: Failed creating subnet
<err> bt_mesh_main: Failed to create network
Align the destroy guard with the import guard so the leak goes away.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
The S-frame should only be sent when there are no I-frames to be sent,
as I-frames have higher priority. Previously, the S-frame flag was
checked in the same condition as other flags, which could cause S-frames
to be sent even when I-frames were available.
Fix by moving the S-frame check to a separate condition that first
verifies no I-frames are pending via `l2cap_br_send_i_frame()`. Also
move the clearing of `L2CAP_FLAG_SEND_S_FRAME` to the end of the
function to ensure it is cleared after any frame is sent, not just
when an S-frame is explicitly sent.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Introduce the helper macros `BT_GOEP_INIT_V1` and `BT_GOEP_INIT_V2`
to simplify and standardize GOEP and GOEP transport initialization for
the upper layer.
Add two new initialization macros that encapsulate the repetitive
pattern of setting up mutual back-pointers between `bt_goep` instances
and related GOEP version-specific transport structures:
- `BT_GOEP_INIT_V1`: Initializes GOEP v1 (RFCOMM) transport by setting
the back-pointer from transport to GOEP, assigning the v1 pointer,
and clearing the v2 pointer.
- `BT_GOEP_INIT_V2`: Initializes GOEP v2 (L2CAP) transport by setting
the back-pointer from transport to GOEP, assigning the v2 pointer,
and clearing the v1 pointer.
And adding type checking via `BUILD_ASSERT` and `SAME_TYPE` in these
two macros to ensure type consistent in building time.
Update all GOEP-based profiles (BIP, PBAP, MAP) and shell code to use
these new added macros.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Introduce a unified `bt_goep_transport` structure to simplify GOEP
transport handling across all profiles.
The added new `bt_goep_transport` structure contains both `v1` and
`v2` transport instances. The upper layer profiles could include the
structure instead of requiring separate structure members when both
GOEP V1.1 and V2 transport are required at the same time.
Update all GOEP-based profiles (BIP, PBAP, MAP) and shell code to use
the unified `goep_transport` structure member instead of separate
`goep_transport_v1` and `goep_transport_v2` members. This reduces code
duplication and provides a consistent pattern across all profiles.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add explicit GOEP v1 and v2 transport structures to PBAP instances
to support the refactored GOEP transport version handling.
Add `bt_goep_transport_v1` and `bt_goep_transport_v2` structure
members to both PBAP client (PCE) and server (PSE) instance types to
align with the refactored GOEP transport handling that uses explicit
version pointers instead of a boolean flag and union.
Initialize the appropriate v1 or v2 structure and set the
corresponding pointer in the parent GOEP instance based on the
transport type (RFCOMM for v1, L2CAP for v2) during connection
establishment and accept operations.
Add NULL parameter validation in PSE accept functions to prevent
potential null pointer dereferences before initializing the GOEP
transport structures.
The change completes the PBAP integration with the new GOEP transport
architecture.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add explicit GOEP v1 and v2 transport structures to MAP instances
to support the refactored GOEP transport version handling.
Add `bt_goep_transport_v1` and `bt_goep_transport_v2` structure
members to all MAP instance types (MCE MAS, MCE MNS, MSE MAS, MSE
MNS) to align with the refactored GOEP transport handling that uses
explicit version pointers instead of a boolean flag and union.
Initialize the appropriate v1 or v2 structure and set the
corresponding pointer in the parent GOEP instance based on the
transport type (RFCOMM for v1, L2CAP for v2) during connection
establishment and accept operations.
The change completes the MAP integration with the new GOEP transport
architecture.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Refactor GOEP transport version handling to use explicit v1/v2
structure pointers instead of a boolean flag and union.
Replace the `_goep_v2` boolean flag and `_transport` union in
`struct bt_goep` with explicit `v1` and `v2` pointers to new
`bt_goep_transport_v1` and `bt_goep_transport_v2` structures. This
improves code clarity and type safety by making the transport version
explicit and avoiding union-based type punning.
The new structures contain:
- `bt_goep_transport_v1`: RFCOMM DLC and back-pointer to parent GOEP
- `bt_goep_transport_v2`: L2CAP channel and back-pointer to parent GOEP
Update all transport operations to use CONTAINER_OF to retrieve
the version-specific structure, then access the parent GOEP
instance through the back-pointer.
Update BIP and shell code to allocate and initialize both v1 and
v2 structures, setting the appropriate pointer based on the
transport type being used.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace implicit NULL and zero checks with explicit comparisons to
improve code readability and follow coding standards.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When a characteristic declaration is passed instead of a value
attribute, ensure the associated characteristic value attribute
permissions are checked before sending notifications, indications
or multiple notifications.
Signed-off-by: Yuan Ye <1275552818@qq.com>
Extended advertising reports as of
https://github.com/zephyrproject-rtos/zephyr/pull/106374 use the
discardable event pool so fragmented chains can be dropped without. That
raised the default discardable buffer size to BT_BUF_EVT_RX_SIZE to fit
general ext-adv reassembly.
Mesh does not need that headroom. The advertising bearer uses
ADV_NONCONN_IND PDUs (Mesh Protocol v1.1 3.3.1), which are legacy
primary-channel advertisements, not fragmented extended advertising
chains. Mesh scan only accepts BT_GAP_ADV_TYPE_ADV_NONCONN_IND, and
legacy reports fit in 58 bytes, the minimum when BT_EXT_ADV is enabled.
Default to 58 for BT_MESH to save RAM.
Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
Introduce a new header file for ASCS as a step
towards decoupling ASCS and BAP.
BAP has a depdendencey on ASCS, but ASCS does not have one
for BAP, and the code should reflect that.
This is a first step that simply removes the requirement
of the BAP Unicast Server in ASCS with minimal changes.
Tasks to follow up with:
- Remove any depedency on bap.h from ascs.c
- Rename everything from ascs.h from bt_bap to bt_ascs where
applicable
- Add unit tests specific for BAP unicast server
- Move any BAP-only requirements from ASCS to the BAP unicast
server implementation.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
There was a race condition where the att_buf could be used for a
write request before the att_buf, containing the result of a long
read, was properly handled first.
Now the unicast client is only marked as not busy after the buffer
has been parsed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add a check to validate that the buffer has sufficient headroom
(BT_L2CAP_CHAN_SEND_RESERVE) before attempting to send data over
a classic L2CAP channel.
Without this validation, buffers allocated with insufficient headroom
could cause buffer corruption when `net_buf_push()` is called to add
the L2CAP header. In the case, the application will be asserted if
the assert is enabled.
The change ensures that callers properly reserve headroom when
allocating buffers for `bt_l2cap_chan_send()`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace `strncmp()` with `memcmp()` for Bluetooth Classic part,
including in AT command parsing and HFP protocol handlers.
Due to the passed `n` of `memcmp()` has been checked and ensured to be
minimum size of the passed two memory blocks, the data of memory block
being compared is not necessarily null-terminated, making `memcmp()`
the more appropriate choice for binary-safe comparisons.
In addition, this change ensures that there are no type mismatch
warnings when using the function `strncmp()`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace atomic_ptr_clear() with net_buf_take() to atomically
transfer ownership of the sent command buffer.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Use net_buf_take() when moving completed SDU buffer from channel
to local variable in LE receive path.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Replace manual pointer transfer with net_buf_take() when moving
completed L2CAP frame from connection rx buffer.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Use net_buf_take() when moving completed SDU buffer from channel
to local variable, replacing manual pointer operations.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Replace manual buf assignment and NULL setting with net_buf_take()
when releasing buffer to bt_l2cap_send_cb.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Checking `params->value` instead of `params->value_handle` is
a more straightforward and less brittle way to determine if a
ccc write response callback is performed due to a subscription
or unsubscription.
Signed-off-by: Sam Friedman <sam@golioth.io>
Remove the use of printk, and replace with bt_shell_print
Remove any excess `\n` that seem to have been leftovers
from a previous fix.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add missing includes and sort where applicable.
This is to follow include-what-you-use.
Assisted-by: Claude:claude-sonnet-4.5
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Having an interface library named "mbedTLS" and the real library named
"mbedtls" (as provided by the Mbed TLS module) is misleading.
This commit replaces:
- mbedTLS -> mbedtls_iface for the CMake library. "mbedTLS" is still
available as alias to "mbedtls_iface" for backward
compatibility, but this should be removed in the future.
- mbedTLS -> Mbed TLS in comments and documentation.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
