Commit graph

9523 commits

Author SHA1 Message Date
Emil Gydesen
7ed8bb5020 Bluetooth: BAP: Add PAST Kconfig dependency for BASS
The broadcast assistant will only be able to send
BT_BAP_BASS_PA_REQ_SYNC_PAST if
CONFIG_BT_PER_ADV_SYNC_TRANSFER_SENDER is enabled.

Similarly the scan delegator will only set
past_supported = true if
CONFIG_BT_PER_ADV_SYNC_TRANSFER_RECEIVER is enabled.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-27 20:47:26 +03:00
Emil Gydesen
8be6db67fc Bluetooth: ISO/BAP: Refactor BIS bitfield
Refactors teh BIS bitfield values used for ISO
and BAP.

Previously BIT(1) meant BIS index 1, which was a Zephyr choice
in the early days of ISO, as the BT Core spec did not use
a bitfield for BIS indexes.

Later the BASS specification came along and defined that
BIT(0) meant BIS index 1, which meant that we had to shift BIS
bitfields between BAP and ISO.

This commit refactors the ISO layer to use BIT(0) for Index 1 now,
which means that there is no longer a need for conversion
between the BAP and ISO layers, and that we can use a value
range defined by a BT Core spec (BASS).

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-27 15:19:46 +03:00
Jonathan Rico
147ee3daaf Bluetooth: host: Send host num completes as early as possible
The Softdevice Controller now sends the disconnect event only after
receiving all Host Num Completes for the packets it sent to the host.
This is done for security reasons.

In our current reassembly logic, it does not really matter when we
withhold the num complete.

Before this patch, it's the first fragment that is withheld, and after
the patch it will be the last fragment that is withheld until the host
is done processing.

The flow control properties are maintained, just in a different way.

Co-authored-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-27 15:18:51 +03:00
Jonathan Rico
32212bfb63 Bluetooth: host: extract sending of host num complete
The functionality is moved in preparation of the next commit which will
re-use this function from somewhere else.

Also add (default-on) asserts that we are able to allocate and send the
command. If that is not the case, we will leak buffers from the PoV of
the controller, leading to a stall in data transfer.

Depending on the error, we could probably recover using a disconnection.
For now, do the safe thing and stop the whole stack.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-27 15:18:51 +03:00
Sean Madigan
4284f99870 bluetooth: host: hci_core: Safer checking of conn complete events
The spec only guarantees the connection complete event parameters
are valid if the status is BT_HCI_ERR_SUCCESS. When the status is
not BT_HCI_ERR_SUCCESS, the host shall ignore the other parameters.

See Vol 4, Part E, 4.5 Command error handling:
"""
If an error occurs for a command for which an HCI_Command_Complete event
is returned, the Return Parameters field may only contain some of the
return parameters specified for the command.
...
The above also applies to commands that have associated command specific
completion events with a Status parameter in their completion event, with
the exceptions shown in Table 4.1, Event Valid parameters
...
Event                           | Valid parameters
------------------------------------------------------------
LE_Connection_Complete          | none
LE_Enhanced_Connection_Complete | none
"""

Refactor `le_legacy_conn_complete`, `le_enh_conn_complete_v2` and
`le_enh_conn_complete` to check and handle the status before handling
any other parameters.

An issue was seen where SDC returned event with status
`BT_HCI_ERR_UNKNOWN_CONN_ID`, but because adv_handle and sync_handle
were not invalid the event was not handled.

Signed-off-by: Sean Madigan <sean.madigan@nordicsemi.no>
2024-07-27 15:18:32 +03:00
Emil Gydesen
f338bf6fae Bluetooth: Host: Discard advertising data if not explicit scanning
If the application is not explicitly scanning, then there is not
really any need to parse advertising reports nor send them to the
application.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-27 15:12:39 +03:00
Vinayak Kariappa Chettimada
04e3d0081b Bluetooth: Controller: Fix Advertising PDU memory allocation
Fix Advertising PDU memory allocation for redundant Periodic
Advertising related PDU allocations. The buffer count
related to Periodic Advertising was included twice.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2024-07-27 15:09:39 +03:00
Rubin Gerritsen
2967bd847f Bluetooth: HCI: Expose bt_hci_conn_lookup_handle()
When implementing vendor specific HCI APIs and events,
we want to be able to convert between host objects,
handles and back again.

Exposing this API makes that possible

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-27 15:09:00 +03:00
Rubin Gerritsen
e28207d61b Bluetooth: HCI: Expose bt_hci_per_adv_sync_lookup_handle()
When implementing vendor specific HCI APIs and events,
we want to be able to convert between host objects,
handles and back again.

Exposing this API makes that possible.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-27 15:09:00 +03:00
Rubin Gerritsen
5b14748616 Bluetooth: HCI: Expose bt_hci_adv_lookup_handle()
When implementing vendor specific HCI APIs and events,
we want to be able to convert between host objects,
handles and back again.

Exposing this API makes that possible.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-27 15:09:00 +03:00
Emil Gydesen
34f4d2d496 Bluetooth: TBS: Add missing endian handling in TBS
TBS had 2 cases where 16-bit values were not properly
converted to LE before being sent over air.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-27 10:48:09 +03:00
Fabio Baltieri
ef14c9b867 lib: os: add a header for printk hook functions
Add a zephyr/printk.h header for the __printk_hook functions, these are
currently manually declared by all console drivers for no good reason.

Move the documentation into the header and also unify the way that
console drivers call the function.

Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
2024-07-27 10:41:01 +03:00
Lyle Zhu
f987057eb3 Bluetooth: BR: SM: Fix ltk derive issue
The BR SMP fixed channel BR/EDR Security Manager
(CID 0x0007) cannot be set in L2CAP Information
Response. It is caused by the invalid fix channel
definition used.

Move macro `BT_L2CAP_BR_CHANNEL_DEFINE` to
`l2cap_br_interface.h`, that the macro can be
accessed in smp.c. And remove duplicated
header file include `#include "classic/l2cap_
br_interface.h"` from smp.c.

Define fixed channel, BR/EDR Security Manager
(CID 0x0007), by using `BT_L2CAP_BR_CHANNEL_DEFINE`.

Fix the smp L2CAP channel of BR cannot be found
issue. Use `bt_l2cap_br_lookup_tx_cid` to get
the BR SMP L2CAP channel instead of using
`bt_l2cap_le_lookup_tx_cid`.

Fix the invalid SMP L2CAP channel used when
the BR smp failed.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-27 10:39:17 +03:00
Rubin Gerritsen
e23345b4d1 Bluetooth: Host: Fix compiling PAwR Sync without PAST RX
The function `bt_hci_le_past_received_v2()` is not compiled
in for this configuration, so the reference needs to be removed.

Fixes #76268.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-27 10:37:56 +03:00
Rubin Gerritsen
c3dd1e8a74 Bluetooth: Host: Fix bt_disable() for IPC giving HCI Reset timeout
Some HCI drivers issue HCI reset when disabling, like the IPC HCI
driver. We need to keep the RX thread running to allow receiving
the command complete.

This commit postpones aborting the RX thread until this is done.
The issue happens started occuring after commit
d0e75ab87c4b53d66008c941c38709a2fca9dbea.

Fixes #76202.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-25 09:14:39 +02:00
Jonathan Rico
792ae68165 Bluetooth: host: Use correct user_data size for hci_rx_pool
`struct acl_data` is used even when Host flow control is not enabled.
It is written to through the `acl(buf)` accessor in `conn.c:hci_acl()`.

Hopefully no netbufs were harmed by that :/

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-13 10:25:31 -04:00
Emil Gydesen
1751a7f190 Bluetooth: TBS: Add missing documentation in tbs.h
Add missing documentation for some defintions in tbs.h
Moved some internal definitions to tbs_internal.h

Removed invalid TBS technology BT_TBS_TECHNOLOGY_IP that
doesn't exist.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-12 06:24:39 -04:00
Rubin Gerritsen
85eadcfddc Bluetooth: Mark bt_<type>_err_to_str() APIs experimental
It was pointed out in a future PR that they should have
a corresponding experimental Kconfig entry.

See PR #73795.

This updates the APIs added in PR #73826 and PR #74295.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2024-07-11 13:11:59 -04:00
Mark Wang
64f38fc348 Bluetooth: A2DP: Fix mistake parameter
After configuration, the stream instance is valid and stream's
local_ep valid. bt_a2dp_stream_establish's parameter is stream
too. So in bt_a2dp_stream_establish, stream->local_ep should be
used to tell lower level (AVDTP) the sep.
set_config_param is used by copy-paste mistake.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2024-07-11 16:16:09 +02:00
Lyle Zhu
f3a1cf2782 Bluetooth: SDP: Fix stack override issue
Check the remaining space of the local variable
`filter` to avoid stack override issue.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-11 16:15:53 +02:00
Emil Gydesen
c4840462bf Bluetooth: BAP: Scan delegator: Add log if actionable CBs are not set
If the callbacks are not set, then we cannot do the requested actions
from the broadcast assistant. Since this is a significant issue,
that may prevent the role from working as intended,
LOG_WRN is used other LOG_DBG.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-11 16:13:55 +02:00
Emil Gydesen
2761204957 Bluetooth: BAP: Fix notifying recv state for bonded devices
The scan_delegator_security_changed function had a few issues
that were addressed:
1) It used an internal field to check level rather than the
   value provided by the API
2) It did not treat bt_addr_le_is_bonded as a boolean return value
3) It did not properly truncate the recv state (fixed by using the
   proper function bass_notify_receive_state)

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-11 12:40:21 +02:00
Jonathan Rico
4afe745a1d Bluetooth: host: Add lower bound for CONFIG_BT_BUF_ACL_RX_COUNT
See comment above assert for more.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-10 11:47:26 -04:00
Emil Gydesen
bbf599a3de Bluetooth: TBS: Remove BT_TBS_TECHNOLOGY_IP
BT_TBS_TECHNOLOGY_IP is not a valid technology value
for TBS since it's not defined by the spec.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-09 19:06:29 +02:00
Pisit Sawangvonganan
9b2ab20f23 bluetooth: fix typo in (include/zephyr/bluetooth, subsys/bluetooth/)
Utilize a code spell-checking tool to scan for and correct spelling errors
in all files within the `include/zephyr/bluetooth` and `subsys/bluetooth`

Signed-off-by: Pisit Sawangvonganan <pisit@ndrsolution.com>
2024-07-09 17:20:38 +02:00
Zihao Gao
6ebb65d163 Bluetooth: fix compiling issue when either A2DP SRC or SNK are not enabled
Some of the A2DP interfaces are not defined if the corresponding feature
is not enabled, and therefore shall not be initialized.
This patchs include the interfaces/variables by the configurations to
go through the compiling stage.

Signed-off-by: Zihao Gao <gaozihao@xiaomi.com>
2024-07-09 14:03:07 +02:00
Emil Gydesen
5901dcbaa7 Bluetooth: Kconfig: Increase BT_HCI_TX_STACK_SIZE for ISO_BROADCAST
When using an encrypted broadcast, the previous value is no
longer enough and caused a stack overflow.

Slightly increased the value.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-08 16:03:21 +02:00
Emil Gydesen
c46b2e086b Bluetooth: Kconfig: Add dependency on BT_CONN for PAST
PAST only works if you have a connection, so the PAST
feature should depend on that.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-08 09:27:11 +02:00
Emil Gydesen
711b42ae16 Bluetooth: Host: Fix recv_enabled field for PAST
When syncing to a PA using PAST then the sync_info.recv_enabled
was always just set to true, regardless of what mode was set
during the subscribe parameters.

The mode(s) are now stored in an array (with the default value
as well) so that we can retrieve that information when the PA
has synced via PAST.

It was considered to put the `mode` value into the `bt_conn`
struct, but that would require an API change as the `bt_conn`
parameter for the subcribe function uses `const`.

This commit also modifies the guard for PAST to be the more
correct value CONFIG_BT_PER_ADV_SYNC_TRANSFER_RECEIVER instead
of just CONFIG_BT_CONN.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-08 09:27:11 +02:00
Emil Gydesen
03d07950aa Bluetooth: OTS: Fix issue with callbacks not being set
The checks for callbacks in bt_ots_init did not correctly take the
ots_init->features.oacp into account for all callbacks, which
caused some issues.

Slightly optimized the check for ots->cb->obj_read by moving the check
and reducing the number of places the code calls oacp_read_proc_cb.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-06 17:02:23 +02:00
Jonathan Rico
be61ae4c9c Bluetooth: host: disallow scan with timeout when BT_PRIVACY=y
See comment in code.

Fixes #73634

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-05 18:43:40 +02:00
Jonathan Rico
a7c5fb7065 Bluetooth: GATT: factor out notify callback
- De-duplicate code
- Add `LOG_WRN` on unsubscribe error

Fixes #74720
Fixes #74721

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-05 18:38:17 +02:00
Lyle Zhu
c9708ff951 Bluetooth: A2DP: Check the pointer before using
Check the pointer `sep` before using it.

Fixes #74734.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-05 12:33:38 +02:00
Lyle Zhu
8276d4f79a Bluetooth: A2DP: Fix NULL pointer references issue
The opposite logic is used to determine if a
pointer is valid.

Correct the judgment logic.

Fixes #74728.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-05 12:32:41 +02:00
Lyle Zhu
6fad658569 Bluetooth: A2DP: Fix NULL pointer references issue
The opposite logic is used to determine if a
pointer is valid.

Correct the judgment logic.

Fixes #74732.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-05 12:32:05 +02:00
Lyle Zhu
9be685eefe Bluetooth: A2DP: Access pointer if it is valid
Only access if the pointer `stream` is valid.

Fixes #74735
Fixes #74740

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-07-05 12:28:45 +02:00
Emil Gydesen
19fe0673f9 Bluetooth: ISO: Tone down some dbg logs
Several log statements were using the regualar LOG_DBG,
but when ISO is actually used, those were called every TX
which at 10ms SDU intervals would fill up the log really fast
and not provided much value outside of some specific debugging.

Modified those logs to use BT_ISO_DATA_DBG which is another
log level for ISO data.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-05 12:28:01 +02:00
Jonathan Rico
ac37d6483a Bluetooth: Host: Remove conn param update checks
The rationale behind that change is that the Application can use the
`bt_conn_le_param_update()` API to signal the controller to reschedule
the link.

Even if the new connection params are within the old ones, the
controller would be free to choose an e.g. smaller interval. The host
API should not prevent this usage.

Fixes https://github.com/zephyrproject-rtos/zephyr/issues/74292

Co-authored-by: Knut Eldhuset <knut.eldhuset@nordicsemi.no>
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-04 18:00:35 -04:00
Emil Gydesen
b413b505ee Bluetooth: BAP: Broadcast: Fix state checks
The existing state checks for both the broadcast sink
and broadcast source only ever checked the first BIS.
This sort of made sense, since they are all linked by HCI
(i.e. they share the same state), but there is a race condition
in the ISO and BAP callbacks that could allow applications
to delete sinks and sources before all the ISO callbacks
had been handled.

By treating the sink and source states as the highest value
of the BIS, then we better treat all BIS the same.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-03 15:28:17 +02:00
Jonathan Rico
85c57c2da3 Bluetooth: host: ensure ownership of conn on TX path
This is a bug-fix:

When upper layers want to send something, they add a `conn` object to a
list. They do so by adding a node on `struct conn` rather than the object
itself.

We forgot to increase the reference count of the connection object when
doing so. This means that there can be a scenario where the conn object is
destroyed and re-used while still being on the TX list/queue.

This is bad for obvious reasons.

This patch fixes that by:
- increasing the refcount when putting on the TX list
- decreasing the refcount *only* when popping off the TX list
- passing a new reference from `get_conn_ready` into `bt_conn_tx_processor`

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
2024-07-02 14:18:23 +02:00
Emil Gydesen
fa447948d2 Bluetooth: BAP: Scan del: Overwrite metadata if len == 0
If the metadata length is 0 in the mod source operation,
we set the length to 0 and memset the stored value.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-07-01 18:14:14 +02:00
Flavio Ceolin
bb56c3898c bluetooth: host/classic: Fix possible buffer overflow
Fix possible buffer overflow in rfcomm. Check the buffer len
before read it.

Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
2024-07-01 09:13:22 +02:00
Emil Gydesen
1159c2adda Bluetooth: OTS: Add return validation of bt_uuid_create for client
The OTS client did not validate the return value of bt_uuid_create.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-06-28 07:50:30 -04:00
Emil Gydesen
7b0784c1f6 Bluetooth: ASCS: Validate num_ases in CP requests
Add validation of the number of ASEs in control point
write requests.

This validates that the number of ASEs
in the control point is not greater than the total number
of ASEs we support.

This also validates that the GATT MTU is large enough to
hold all the responses from the write since those can only be
sent as notifications and never be truncated.

Finally this validates and updates the size of the buffer used to
hold the responses, which may be an optimization for some builds.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-06-28 07:20:47 -04:00
Jordan Yates
91f8c1aea9 everywhere: replace #if IS_ENABLED() as per docs
Replace `#if IS_ENABLED()` with `#if defined()` as recommended by the
documentation of `IS_ENABLED`.

Signed-off-by: Jordan Yates <jordan@embeint.com>
2024-06-28 07:20:32 -04:00
Jordan Yates
cf870e8350 bluetooth: correct bt_le_scan_param scan type
The `type` parameter of `struct bt_le_scan_param` is documented as
taking a `BT_LE_SCAN_TYPE_*` value, not a `BT_HCI_LE_SCAN_*` value.

In practice this makes no difference as the values are defined as the
same integer, but does result in `<zephyr/bluetooth/hci.h>` not needing
to be included.

Signed-off-by: Jordan Yates <jordan@embeint.com>
2024-06-28 11:34:36 +02:00
Emil Gydesen
044f8aaeb3 Bluetooth: OTS: Add len validation in olcp_ind_handler
Verify the length of the indication before we pull from the
buffer.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2024-06-27 08:49:20 -04:00
Babak Arisian
0c611d01a7 Bluetooth: Audio: Dereference null return value in cap_initiator.c
Null pointer dereferences in functions:
  bt_cap_initiator_unicast_audio_update (Line 1478)
  bt_cap_initiator_unicast_audio_stop (Line 1693)

Fixes #74729 and #74739

Signed-off-by: Babak Arisian <bbaa@demant.com>
2024-06-27 08:48:46 -04:00
Babak Arisian
a895abab86 Bluetooth: Audio: Unchecked return value in audio.h
Unchecked return value in functions: print_ltv_array (Line 287)

Fixes #74733

Signed-off-by: Babak Arisian <bbaa@demant.com>
2024-06-27 08:48:18 -04:00
Lyle Zhu
1d1dc7a875 Bluetooth: Classic: HF_AG: Fix unexpected return
When `buf->len` is 0, the function of the while-loop
will be returned with error code `-ENOTSUP`.
The code block after while-loop cannot be reached
event though it is a correct command.

Use `buf->len` as the end condition of the while-loop.

Fixes #74730.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2024-06-27 10:53:17 +02:00