Refactor GOEP transport version handling to use explicit v1/v2
structure pointers instead of a boolean flag and union.
Replace the `_goep_v2` boolean flag and `_transport` union in
`struct bt_goep` with explicit `v1` and `v2` pointers to new
`bt_goep_transport_v1` and `bt_goep_transport_v2` structures. This
improves code clarity and type safety by making the transport version
explicit and avoiding union-based type punning.
The new structures contain:
- `bt_goep_transport_v1`: RFCOMM DLC and back-pointer to parent GOEP
- `bt_goep_transport_v2`: L2CAP channel and back-pointer to parent GOEP
Update all transport operations to use CONTAINER_OF to retrieve
the version-specific structure, then access the parent GOEP
instance through the back-pointer.
Update BIP and shell code to allocate and initialize both v1 and
v2 structures, setting the appropriate pointer based on the
transport type being used.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace implicit NULL and zero checks with explicit comparisons to
improve code readability and follow coding standards.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When a characteristic declaration is passed instead of a value
attribute, ensure the associated characteristic value attribute
permissions are checked before sending notifications, indications
or multiple notifications.
Signed-off-by: Yuan Ye <1275552818@qq.com>
Extended advertising reports as of
https://github.com/zephyrproject-rtos/zephyr/pull/106374 use the
discardable event pool so fragmented chains can be dropped without. That
raised the default discardable buffer size to BT_BUF_EVT_RX_SIZE to fit
general ext-adv reassembly.
Mesh does not need that headroom. The advertising bearer uses
ADV_NONCONN_IND PDUs (Mesh Protocol v1.1 3.3.1), which are legacy
primary-channel advertisements, not fragmented extended advertising
chains. Mesh scan only accepts BT_GAP_ADV_TYPE_ADV_NONCONN_IND, and
legacy reports fit in 58 bytes, the minimum when BT_EXT_ADV is enabled.
Default to 58 for BT_MESH to save RAM.
Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
Introduce a new header file for ASCS as a step
towards decoupling ASCS and BAP.
BAP has a depdendencey on ASCS, but ASCS does not have one
for BAP, and the code should reflect that.
This is a first step that simply removes the requirement
of the BAP Unicast Server in ASCS with minimal changes.
Tasks to follow up with:
- Remove any depedency on bap.h from ascs.c
- Rename everything from ascs.h from bt_bap to bt_ascs where
applicable
- Add unit tests specific for BAP unicast server
- Move any BAP-only requirements from ASCS to the BAP unicast
server implementation.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
There was a race condition where the att_buf could be used for a
write request before the att_buf, containing the result of a long
read, was properly handled first.
Now the unicast client is only marked as not busy after the buffer
has been parsed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add a check to validate that the buffer has sufficient headroom
(BT_L2CAP_CHAN_SEND_RESERVE) before attempting to send data over
a classic L2CAP channel.
Without this validation, buffers allocated with insufficient headroom
could cause buffer corruption when `net_buf_push()` is called to add
the L2CAP header. In the case, the application will be asserted if
the assert is enabled.
The change ensures that callers properly reserve headroom when
allocating buffers for `bt_l2cap_chan_send()`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace `strncmp()` with `memcmp()` for Bluetooth Classic part,
including in AT command parsing and HFP protocol handlers.
Due to the passed `n` of `memcmp()` has been checked and ensured to be
minimum size of the passed two memory blocks, the data of memory block
being compared is not necessarily null-terminated, making `memcmp()`
the more appropriate choice for binary-safe comparisons.
In addition, this change ensures that there are no type mismatch
warnings when using the function `strncmp()`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Replace atomic_ptr_clear() with net_buf_take() to atomically
transfer ownership of the sent command buffer.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Use net_buf_take() when moving completed SDU buffer from channel
to local variable in LE receive path.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Replace manual pointer transfer with net_buf_take() when moving
completed L2CAP frame from connection rx buffer.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Use net_buf_take() when moving completed SDU buffer from channel
to local variable, replacing manual pointer operations.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Replace manual buf assignment and NULL setting with net_buf_take()
when releasing buffer to bt_l2cap_send_cb.
Signed-off-by: Dharun krithik k <dharunkrithik@aerlync.com>
Checking `params->value` instead of `params->value_handle` is
a more straightforward and less brittle way to determine if a
ccc write response callback is performed due to a subscription
or unsubscription.
Signed-off-by: Sam Friedman <sam@golioth.io>
Remove the use of printk, and replace with bt_shell_print
Remove any excess `\n` that seem to have been leftovers
from a previous fix.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add missing includes and sort where applicable.
This is to follow include-what-you-use.
Assisted-by: Claude:claude-sonnet-4.5
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Having an interface library named "mbedTLS" and the real library named
"mbedtls" (as provided by the Mbed TLS module) is misleading.
This commit replaces:
- mbedTLS -> mbedtls_iface for the CMake library. "mbedTLS" is still
available as alias to "mbedtls_iface" for backward
compatibility, but this should be removed in the future.
- mbedTLS -> Mbed TLS in comments and documentation.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
With CONFIG_BT_MAX_CONN=1, restarting connectable advertising from
the bt_conn_cb.disconnected callback fails with -ENOMEM because the
BLE host still holds a connection reference at that point. The
connection slot is only guaranteed free when bt_conn_cb.recycled fires.
Two code paths in gatt_disconnected() called bt_mesh_adv_gatt_update()
indirectly, triggering bt_le_ext_adv_start() before the connection
slot was freed:
pb_gatt_srv: on the provisioned path, bt_mesh_pb_gatt_srv_disable()
was called, which internally triggers bt_mesh_adv_gatt_update().
proxy_srv: when the proxy service was not yet registered upon
disconnect, bt_mesh_proxy_gatt_enable() was called, which also
triggers bt_mesh_adv_gatt_update().
Extract prov_gatt_service_unregister() and proxy_gatt_service_register()
as private helpers that perform only the GATT service operation without
triggering advertising. Have gatt_disconnected() call these helpers
and set adv_restart_pending = true in all branches, so conn_recycled()
safely handles the advertising restart after the connection is freed.
Assisted-by: GitHub Copilot:Claude Sonnet 4.6
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
When a PB-GATT or GATT Proxy connection disconnects on a device with
CONFIG_BT_MAX_CONN=1, the mesh stack attempts to restart connectable
advertising from the disconnected callback. This fails with -ENOMEM
because the BLE host still holds a reference to the connection object
at that point, and bt_le_ext_adv_start() cannot pre-allocate a new
connection slot.
Fix this by using the bt_conn_cb.recycled callback to trigger
advertising restart. The recycled callback fires only after the
connection object is fully released, guaranteeing a free slot is
available for connectable advertising.
Remove bt_mesh_adv_gatt_update() from bt_mesh_proxy_role_cleanup()
and instead set an adv_restart_pending flag in the disconnected
handler. The recycled callback checks this flag to avoid unnecessary
advertising restart attempts from unrelated disconnections.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
In `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()`, `buf->len` is used
to validate the minimum packet size. However, `buf->len` may exceed the
actual command data length (the `len` parameter from the L2CAP
signaling header), as the buffer can contain data beyond the current
command.
When the command data length `len` is smaller than the minimum packet
size, but `buf->len` is not less than the minimum packet size, the
validation passes incorrectly. Subsequently, when calculating `opt_len`
(`len - sizeof(*req)`), an underflow occurs duw to the value of type
`uint16_t`, resulting in an out-of-bounds buffer access issue.
Fix by validating against the `len` parameter instead of `buf->len` in
both `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()`, since `len`
reflects the actual command data length.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When sc=0, a framed ISO PDU segment header includes a 3-byte time_offset
field, so seg_hdr->len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE.
isoal_check_seg_header() accepted segments with sc=0 and len<3 as valid,
allowing isoal_rx_framed_consume() to underflow, causing an
out-of-bounds read of up to 255 bytes of adjacent memory into an HCI ISO
packet delivered to the host.
Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
In prov_msg_recv(), the protocol timer was reset unconditionally at
the top of the function, before the FCS check and before the
ADV_LINK_INVALID check. When the link has been marked invalid (e.g.
after a provisioning failure), any incoming PB-ADV packet with a
passing FCS would still reset the timer, preventing
protocol_timeout() from firing and closing the link via
prov_link_close().
Move k_work_reschedule() to after the ADV_LINK_INVALID check so the
timer is only reset for valid PDUs on an active, non-failed link.
Move the FCS check before the timer reset for the same reason.
Once ADV_LINK_INVALID is set the protocol timer is no longer
extended by incoming packets, and the link is closed by
protocol_timeout() as intended, after which the unprovisioned
device beacon and PB-ADV link acceptance are restored.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
Since commit 37717b229f ("sys: util: rename Z_MIN Z_MAX Z_CLAMP to min
max and clamp"), <zephyr/sys/util.h> unconditionally defines function-
like macros named `min`, `max`, and `clamp` in the global namespace (in
C mode). util.h gets pulled in transitively by very broad headers,
including the POSIX layer's <pthread.h>, so any third-party C code that
uses these names as ordinary identifiers (e.g. XNNPACK's static `clamp`
helper and its public `clamp` struct field) fails to build as soon as
<pthread.h> is included.
Following the approach used by Linux, move the lowercase `min`, `max`,
`min3`, `max3`, and `clamp` macros (and their helpers) into a new
<zephyr/sys/minmax.h> header that has to be included explicitly by
source files that want them. util.h keeps the uppercase MIN/MAX/CLAMP,
so most code is unaffected; only the (much smaller) set of files that
actually use the lowercase variants needs to pick up the new include.
Fixes#107853.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
The when the reception stopped callback was called, we should
call bt_cap_handover_broadcast_reception_stopped and not
cap_handover_broadcast_audio_stopped, as we need to stop the
broadcast as a result of it, and not just delete it.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Fix expressions where increment or decrement operators are combined
with other side effects in the same full expression, violating
MISRA-C Rule 13.3.
Separate the increment and decrement operations into standalone
statements to ensure each full expression contains at most one
side effect.
Assisted-by: GitHub Copilot
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add missing error checks for any function calls in the
affected files, as that is required by the Zephyr coding guidelines.
The call to bt_ots_client_register in mcc.c was moved to
avoid calling it mulitple times, causing it to fail if
bt_mcc_discover_mcs was called more than once.
Assisted-by: Copilot:claude-sonnet-4.6
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add a LOG_DBG for all aborts so that it is easier
to determine the exact reason for an aborted CAP
procedure.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Minor change to valid_unicast_to_broadcast_metadata to break
the loop earlier if the unique_metadata_cnt is already too
large.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
bt_avdtp_parse_capability_codec() returns immediately after parsing the
Media Codec service category, skipping any subsequent service categories
in the capability list. This causes the Delay Reporting service category
(0x08) to be missed when it appears after the Media Codec in a Set
Configuration command.
Fix by replacing 'return 0' with 'break' so the while loop continues
to parse remaining service categories. Also update the final return to
check whether a codec was actually found.
Signed-off-by: Zihao Gao <gaozihao@xiaomi.com>
Update the documentation for the uncast_x_complete callbacks
so that applications can better determine what `err` might be
and act according to the error.
It also makes the disconnect callback more unique, as well
as treating control point write rejects different from
invalid state changes.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The characteristic name and definitions in the TBS spec for
the values are "optional opcodes" instead of "support features".
Additionally, the field is 16-bit, instead of the current 8-bit
in the register parameters.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
It doesn't really serve a purpose since the addition of
CONFIG_PSA_CRYPTO.
Replace remaining uses of the former by the latter.
TF-M now implies CONFIG_PSA_CRYPTO the same way as
CONFIG_MBEDTLS because otherwise we get build failures
if we build Mbed TLS without CONFIG_PSA_CRYPTO enabled.
Hopefully we can remove these two in a later PR.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Fix missing static const qualifier on the version number
look up array declaration.
Without this fix, str was an automatic array inside
bt_hci_get_ver_str(), consuming stack on each call.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Add shell support for the bt_conn_br_change_packet_type() API:
- Add 'br change-packet-type <hex>' shell command to allow
changing ACL packet types on an established BR/EDR connection.
- Add br_packet_type_changed callback to print the
HCI_Connection_Packet_Type_Changed event result.
- Register the callback in conn_callbacks.
This addresses the review feedback requesting shell/test support
for the change connection packet type feature.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Add bt_conn_br_change_packet_type() API to dynamically change the
allowed packet types for an established BR/EDR connection. This
enables throughput optimization by selecting appropriate packet
types (DM/DH 1/3/5 slots) based on application requirements.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Introduce BT_RFCOMM_OVERHEAD_SIZE macro to calculate the RFCOMM frame
overhead, which includes the maximum header size, FCS size, and
credits size.
This refactoring:
- Defines BT_RFCOMM_CREDITS_SIZE (1 byte) as a public constant
- Consolidates overhead calculation in a single macro
- Updates all MTU calculations to use BT_RFCOMM_OVERHEAD_SIZE
- Removes redundant credits size adjustment in rfcomm_dlc_connected()
since the overhead is now accounted for upfront in session MTU
calculation
- Simplifies code in GOEP by using the new macro instead of manual
header size calculations
- Change the range of BT_GOEP_RFCOMM_MTU to [265, BT_RFCOMM_L2CAP_MTU]
The change ensures consistent MTU calculations across RFCOMM and
dependent profiles (HFP, GOEP) and accounts for the credits field in
CFC-supported scenarios from the start.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Since the Broadcast Assistant implementation may have a
pending request _per_ instance, each instance needs its own
buffer to accomodate that, otherwise we may risk overwriting
data between instances. This follows the design used in the
BAP Unicast Client
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The wr_chunk function had a fast path for devices without explicit erase
(e.g. nRF54L RRAM) that wrote chunk data directly without aligning the
offset or size to the flash write block size. On RRAM with
write-block-size=16, this caused -EINVAL from the flash driver for every
chunk write since chunk_size (161) and most chunk offsets are not
16-byte aligned.
The failed writes caused the BLOB server to never mark chunks as
received, resulting in block_status_rsp always reporting all chunks
missing. This led to infinite retransmission of block 0 and eventual
DFU timeout.
Fix by using a read-modify-write approach for non-erase devices:
read existing data at the aligned boundaries, overlay the chunk data,
and write back the full aligned buffer. This satisfies the driver's
alignment requirements while preserving neighboring bytes.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
bt_iso_recv pulls the SDU header (with or without) timestamp,
but did not check the length of `buf` before doing so.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Introduces K_MEM_SLAB_DEFINE_TYPE() and K_MEM_SLAB_DEFINE_STATIC_TYPE()
helpers to allow the user to declare slabs for types without having to
manually ensure the alignment is correct.
Manual slab alignment was very error-prone and this change fixes several
instances of misalignment that would be trapped by the undefined
behavior sanitizer when running on 64-bit targets.
Signed-off-by: Egill Sigurdur <egill@egill.xyz>
393350fd65 made it so that the `mbedTLS`
library is only created when `CONFIG_MBEDTLS_BUILTIN`.
Before this commit, users of Mbed TLS did the following:
`zephyr_library_link_libraries_ifdef(CONFIG_MBEDTLS mbedTLS)`
If the `mbedTLS` CMake library doesn't exist but is still linked to
(as is the case when `CONFIG_MBEDTLS && !CONFIG_MBEDTLS_BUILTIN`),
the linker command is populated with `-lmbedTLS` which makes the build
fail because there is no `libmbedTLS.a` in the build.
Make it so that users of Mbed TLS only link to the `mbedTLS` CMake
library when the builtin version is used.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
With adding discard-tracking of extended advertising reports, the
reports are allocated from the discardable event pool instead of the
"normal" event pool. This commit sets the default value of
BT_BUF_EVT_DISCARDABLE_SIZE to BT_BUF_EVT_RX_SIZE when BT_EXT_ADV
is enabled.
Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
Extends the `host/scan/slow` bsim test to test that the reassembler
is able to recover from a discarded extended advertising report chain.
This requires tracking that extended advertising reports are in fact
received, and that the reassembler times out. Functions for this are
added to testing.h which is only compiled if BT_TESTING is enabled.
Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
