The LE Secure connection (LESC) mask also require encryption,
and some users have been using e.g. BT_GATT_PERM_READ_LESC
without BT_GATT_PERM_READ_ENCRYPT, and then the encryption
check in bt_gatt_check_perm was never properly applied.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The shift is currently necessary due to a mismatch of the
specs and the API, but the shift should not be done when
the value is BT_BAP_BIS_SYNC_NO_PREF as that is a special value.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
In the unicast_client_ep_notify we would always call
bt_gatt_get_mtu, regardless of whether data == NULL.
When there is a disconnection, the notify callbacks are
called with data == NULL to indicate a unsubscription.
In the case of the unicast client, this would also trigger
calls to bt_gatt_get_mtu when there is a disconnect, which
in turn would trigger a warning that ATT is not connected.
Postponing the call to bt_gatt_get_mtu fixes this.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This served no purpose for responces. The minimum MTU is sufficient for
all ATT headers.
Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
When EATT is enabled, bt_att_create_rsp_pdu used to reserve headroom for
the SDU header even when responding on the UATT bearer.
That subtracted from the room for the ATT payload in the buffers. The
remaining buffer size was insufficient to create a PDU of ATT MTU size,
since the exchanged local MTU is calculated the with the assumption that
the SDU header is not present.
This broke the ATT MTU promise, and e.g. our read response will have two
bytes fewer than promised. This caused a failure in PTS.
The new bt_att_create_rsp_pdu pays attention to the bearer type and only
allocates the SDU header on EATT bearers.
Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
The unicast_stop command takes either "all" or one or more
stream pointers as argument, but the argument handler did
not allow this.
The documentation for the command was also out of date.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The context had a bug where if GMAP was enabled, the context
was only BT_AUDIO_CONTEXT_TYPE_GAME.
The context should also (per BAP spec requirement) contain the
BT_AUDIO_CONTEXT_TYPE_UNSPECIFIED context.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Fix LLL ISO stream get by group to return stream context
sorted by CIS offset in ascending order.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
The Broadcast Assistant API should be fully independent of the scan
delegator. Therefore the new struct bt_bap_bass_subgroup has been
defined to avoid a dependency.
Fixes: #68338
Signed-off-by: Ping Wang <pinw@demant.com>
The warning should only apply for configurations where the
device may actually send ISO data (e.g. not the ISO sync receiver).
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The bt_iso_chan_send function could take an optional
timestamp by using 0 as an indicator. The issue with
this approach was that a timestamp value of 0 is valid,
and could cause potential issue with syncing streams
in a group.
To fully support transmitting with and without timestamp,
bt_iso_chan_send_ts has been introduced, which is the only
function of the two (bt_iso_chan_send being the other) that
supports timestamps.
A new function, rather than adding a boolean to the existing,
was chosen as it simplifies the individual functions as well
as making it more explicit what the function does.
Since the bt_iso_chan_send function is used by LE audio, both
the BAP and CAP send functions have similarly been updated.
Likewise, all tests and samples have been updated to use the
updated function(s), and BT_ISO_TIMESTAMP_NONE has been
removed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The calculation for BASE_SUBGROUP_MAX_COUNT was off by one.
The macro did not consider the non-subgroup parameters of
the BASE that take up space. This effectively modifies
BASE_SUBGROUP_MAX_COUNT to be 24 instead of 25.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Disable randomization at the access layer in the Remote Provisioning
server when sending Link Stauts message as a responce on Link Close
message and then sending Link Report message right after it. Because of
the randomization, the report message is sent before the status message
which makes MESH/SR/RPR/PDU/BV-03-C test to fail.
This fixes MESH/SR/RPR/PDU/BV-03-C test.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Disable randomization in the access layer when cancelling update in the
distribution server model. This is needed because the server sends 2
messages in a row and the gets reordered by the access layer
randomization feature making DFU/SR/FD/BV-43-C test to fail.
This fixes DFU/SR/FD/BV-43-C test.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
It is unclear from a cursory glance at the code what the caller of
`send_buf(buf)` should do with `buf` based on the returned error codes.
Document when ownership is and isn't transferred to `send_buf()`.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Verify the connection is active before popping the buffer from the TX
queue.
The current behavior enables a race condition between `create_frag` and
the connection being torn down, as `buf` can be popped from the TX queue
but not destroyed by `bt_conn_process_tx`.
In that case, `buf` will be leaked.
Original analysis and fix proposal by @watsug.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Reported-by: Adam Augustyn<watsug@gmail.com>
Once an ISO channel has connected, the sequence number
always starts at 0. This reset was missing in the implementation,
and the _prev_seq_num from a previous connection may have
been kept.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Before a LL_FEATURE_REQ is sent, verify that the Data Length Update
procedure is still supported as it could have been unmasked as the result
of a previously completed Feature Exchange procedure.
Add unit test to verify the case of enqueuing both a
Feature Exchange procedure and Data Length Update procedure, where the
Feature Exchange procedure would result in the unmasking of the Data
Length Update procedure.
Signed-off-by: Thomas Ebert Hansen <thoh@oticon.com>
Resume the TX Data Q when a LL_UNKNOWN_RSP is recieved instead of a
LL_PHY_RSP.
Update PHY Update unit test with more coverage of the TX Data Q pause
state.
Signed-off-by: Thomas Ebert Hansen <thoh@oticon.com>
This will warn if any of the mesh module will try to send anything while
the stack is suspended. Not clear what to do here as both advertisers
(legacy and ext) behaves differently. The legacy advertiser has a
thread which is stopped after the `bt_mesh_adv_disable` call and any
sent advs after suspending the stack will stay in the pool until the
advertiser is resumed. The extended advertiser will schedule its work,
but then fail because `ext_adv->instance` value is NULL, but will call
`bt_mesh_send_cb.start` with error `-ENODEV`. What to do with these 2
behaviors is unclear at the moment. Ideally none of the mesh stack
modules should call `bt_mesh_adv_send` after the stack was suspended, so
if this warning appears, the faulty module wasn't stopped properly and
this should be fixed. If not to add the adv to the pool, then it kind
of gets lost as the implementation probably expects one
of `bt_mesh_send_cb` callbacks which will never be called. Leaving the
warning until clear customer request comes.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
During local testing with UBSAN enabled, warning was reported:
bluetooth/host/l2cap.c:980:25: runtime error: member access
within null pointer of type 'struct k_work_q'
It turned out that le_chan->rtx_work.queue can be NULL.
Since null-pointer dereference is a UB, additional check
was added to ensure we don't access
`le_chan->rtx_work.queue->thread` when
`le_chan->rtx_work.queue == NULL`
The same changes applied to l2cap_br.c
Signed-off-by: Ivan Iushkov <ivan.iushkov@nordicsemi.no>
During local testing with UBSAN enabled, warning was reported:
bluetooth/host/iso.c:237:2: runtime error: null pointer passed
as argument 2, which is declared to never be null
It turned out that when datapath doesn't contain
codec information, cc_len is 0 and cc is NULL
In order to avoid UB,
now we call memcpy only when cp->codec_config_len > 0
Signed-off-by: Ivan Iushkov <ivan.iushkov@nordicsemi.no>
during local testling, UBSAN reported the following warnings:
- bluetooth/host/adv.c:2067:19: runtime error: shift exponent
255 is too large for 32-bit type 'long unsigned int'
- bluetooth/host/scan.c:828:18: runtime error: shift exponent
255 is too large for 32-bit type 'long unsigned int'
It turned out that we can't use BIT() macro directly on
bt_hci_evt_le_per_advertising_report::cte_type field.
According to Core Spec, `cte_type = 0xFF` corresponds
to `No contstant tone extension`.
Added separate function to convert CTE bit field from
HCI format to bt_df_cte_type
Signed-off-by: Ivan Iushkov <ivan.iushkov@nordicsemi.no>
If `CONFIG_BT_MESH_GATT_SERVER` is disabled or the advertising set
doesn't support proxy adv, the solicitation PDU will not be sent.
However, solicitation PDU transmission doesn't depend on the proxy
feature of the device it sends. Therefore, solicatation PDU should be
sent regradless of `CONFIG_BT_MESH_GATT_SERVER` option and advertiser
tag.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Removed the "operation" infix from the bt_gatt_authorization_cb
callback structure in the Bluetooth GATT header.
Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
Trigger erasing solicitation settings before calling
`bt_mesh_settings_store_pending` and `bt_mesh_prov.reset` callback.
The `bt_mesh_settings_store_pending` flushes every settings that is
pending to be erased. The `bt_mesh_prov.reset` callback must be called
as the last step because a user is free to do anything from this
callback including rebooting or reprovisioning the device.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Since we may go from enabling to qos-configured state if the
call to bt_iso_big_create fails, that is a valid transition.
If bt_iso_big_create currently fails, then the source ends in a
state where it cannot be recovered.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When CONFIG_BT_ISO_TEST_PARAMS is enabled then the
bt_bap_broadcast_source_param in
bt_cap_initiator_broadcast_audio_create had uninitialized values.
A general and future proof solution for this is to simply initialize
the entire struct to 0.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modifies two log statements so that it is clear whether it
is failing to validate broadcast or unicast PDU sizes.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modify the broadcast assistant commands that take the PA sync argument
so that it is treated as a bool. This allows users to use
"true", "on", "1" or "0x01" for true values and "false", "off", "0"
for false values.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Advertising data has to be truncated at a PDU boundary
Similar to earlier fix for extended advertising reports
Found in several EBQ tests, including LL/DDI/SCN/BV-25-C,
LL/DDI/SCN/BV-21-C and LL/DDI/SCN/BV-46-C
Signed-off-by: Troels Nilsson <trnn@demant.com>
The SCO cannot be created if the eSCO is unsupported.
It is caused by the packet type cannot be set
correctly.
Set valid bitmap for SCO and eSCO packet type in
command "Accept Synchronous Connection Request".
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
In the update_recv_state_base function, we should update the
BASE with any new metadata that we have received (as that may
change while streaming). However, this function did not properly
keep the existing bis_sync values for the
subgroups, causing the bis_sync for all subgroups to be 0.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The receive state may be added by the broadcast sink if not added
by the application, but even in that case when the broadcast sink
is deleted, we should not remove the receive state, as the receive
state may still container information about the PA sync that has a
lifetime not coupled with the broadcast sink.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If the receive state is locally removed, then we should not
request permission from the application, as that is implicit
when removing the source locally.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The defines from the Bluetooth Audio assigned numbers are not
specific for LC3. This commit removes the LC3 infix and
the reference to LC3 in the documentation for them.
It also cleans up some of the documentation and
names of the enums.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Some places VCP accessed AICS and VOCS when it was not supported.
Also modify existing guards to be consistent with new guards.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The VCP and MICP instances should use their respective
AICS and VOCS Kconfig options, rather than the overall
Kconfig options.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modify the parameters for bt_cap_initiator_unicast_audio_stop
so that they are more similar to
bt_cap_initiator_unicast_audio_start.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modify the parameters for bt_cap_initiator_unicast_audio_update
so that they are more similar to
bt_cap_initiator_unicast_audio_start.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit updates nordic lll controller to use
IRQ_DIRECT_CONNECT where applicable instead of
using IRQ_CONNECT with ISR_FLAG_DIRECT.
Signed-off-by: Radosław Koppel <radoslaw.koppel@nordicsemi.no>
The LE Audio implementations do not really support bonding yet,
and removing subs on disconnect is the most effective (and correct)
way of ensuring that we do not subscribe more than once when we
re-discover after reconnection.
The broadcast assistant and the media control client does not
support multiple connections as of this commit, so they needed
special treatment. In the case that we do discovery on multiple
ACL connections, it is important that the existing subscriptions
are removed correctly by calling bt_gatt_unsubscribe.
In order to implement this change properly on some of the clients,
thet had no proper connection references or support
for clearing the data on disconnects, they had to be updated
as well.
The csip_notify.sh test has been disabled, as that expected a
notification in the client, but since this commit removes that
(until bonding is properly supported in the clients), then the
test will fail.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Several places the LE Audio clients called bt_gatt_subscribe without
checking the return value, which could cause some issues in the worst
case, and in the best case, cause some unexpected behavior.
Some implementations had a bit more updating to handle the new
behavior.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The user data size of hfp tx pool is zero.
There is not enough space to put tx_mate.
Use CONFIG_BT_CONN_TX_USER_DATA_SIZE to
set data size of hfp tx pool.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Fix Periodic Advertising Synchronization leading to
Peripheral ACL connection supervision timeout, due to
direction finding related radio hardware registers being
updated in the implementation that is not built for
direction finding feature support.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
