BT_HCI_ERR_LOCALHOST_TERM_CONN is not a valid reason to
send to the remote.
Changed to BT_HCI_ERR_REMOTE_USER_TERM_CONN
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Since we may receive a BASE often, some of the log statements
could end up flooding the log. Add RATELIMIT to those that either
directly discards the BASE or logs as WRN.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Adds checks for the number of subgroups as well as the size
of the metadata when we parse the BASE, in the case that the
bt_bap_scan_delegator_mod_src_param does not support the number
of subgroups or the metadata.
If the number of subgroups is the issue, then we discard the BASE
as we would otherwise write incorrect data to the receive state.
If the size of the metadata is the issue, then we just don't write
it to the receive state, as that is not mandatory as per BASS.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove the special handling of metadata_len == 0 to keep existing
metadata, as this prevents applications from actually setting the
metadata_len to 0.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Use #include <> instead of #include "" to include a header file which path
is not relative to the directory path of the file emitting the #include
directive.
This change was made running scripts/check_quoted_includes.py script
proposed in https://github.com/zephyrproject-rtos/zephyr/pull/112135
with the Linux shell command below and manually selecting the applicable
changes:
$ ./scripts/check_quoted_includes.py -w subsys/bluetooth/host/classic/
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
The interval validation in valid_adv_ext_param() capped the maximum
interval at 0x4000 (the legacy advertising limit). Extended advertising
uses a 24-bit interval field with a permitted range of 0x000020–0xFFFFFF
per Core Spec Vol 4, Part E, 7.8.53. Use BT_HCI_LE_PRIM_ADV_INTERVAL_MAX
when BT_LE_ADV_OPT_EXT_ADV is set, and remove the now-unused
adv_interval_max_get() helper.
Assisted-by: Augment:claude-sonnet-4.6
Signed-off-by: Sharon Lin <slin@atmosic.com>
Change the registration of the PA sync callbacks to be
more lazy (only do it when we are trying to do any PA
related activities).
This not only defers such operations until they are useful,
but also helps reduce noise when using the LE Audio shell.
This also reduces the scope of per_adv_sync_cb as well
as moving the related functions to a single guard.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Added help text for the BT_CONN, BT_AUDIO_RX, and BT_AUDIO_TX options.
While these are promptless, they are worth explaining and should show up
in Kconfig reference doc page.
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Add additional check to avoid printing the same error
for each SDU. If the SDU length changes, then it is still
printed every time to notify the user about
such behavior from the remote (useful for debugging), so it
is only if the SDU size is wrong and does not change that
we rate limit it.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The member_params variable can be quite large, and scales with
CONFIG_BT_MAX_CONN. Make it static to avoid requiring a large
stack size.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit resolves -Wpointer-sign warnings in the Bluetooth Mesh
subsystem by updating comp_data_pages[] to store a const char *path and
updating bt_mesh_k5 to natively accept const char *p, avoiding the need
for pointer casts.
This is part of a larger effort to fix pointer-sign warnings across the
codebase in preparation for dropping -Wno-pointer-sign globally.
Related to #8921
Signed-off-by: harshit kudhial <harshitkudhial@gmail.com>
The last callers of bt_testing_tx_tid_get() were removed by
commit 28be8909a6 ("Bluetooth: host: remove TX thread"), which also
changed the function to return the system workqueue thread. That return
value has in turn been stale since
commit f101976e31 ("Bluetooth: Host: Run tx processor on its own thread")
moved TX processing to a dedicated thread whenever
CONFIG_BT_TX_PROCESSOR_THREAD is enabled (the default).
Instead of fixing the return value of a function nobody calls, remove
it, together with the leftover extern declarations in the bsim tests.
The att/pipeline test enabled CONFIG_BT_TESTING solely for this
function, so drop it there. The att/sequential test claimed the same in
a comment, but actually also depends on CONFIG_BT_TESTING for
bt_conn_suspend_tx(), so only the stale comment is corrected there.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Assisted-by: Claude:claude-fable-5
If we are pending PAST, we do not have a pa_sync object to delete, but
we should not rejec the request to stop the sync, as that indicates
that we should just stop waiting.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Two CCC callbacks used K_FOREVER instead of MUTEX_TIMEOUT
as the mutex timeout. Change to be consistent and to avoid
blocking everything in case that it could not lock the mutex.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove the pa_sync_state parsing from
cmd_bap_scan_delegator_bis_synced as it was not used by the command,
and caused the parsing of the bis_synced value to fail.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
In the sync_state_get_or_new we should compare with the src_id instead
of the pointer. If the receive state was added locally via
cmd_bap_scan_delegator_add_src then the src_id is assigned, but not
the pointer. This caused any locally added receive states to be
unavailable, and thus causing error prints when using the
shell module.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Mark static variables bip_app, rfcomm_server, and l2cap_server with
ZTESTABLE_STATIC to allow them to be accessed from unit tests while
maintaining static linkage in production builds.
Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
Fix typo in `BT_AVDTP_UNSUPPORTED_CONFIGURATION` constant name.
The constant was misspelled as `BT_AVDTP_UNSUPPORTED_CONFIGURAION`.
Update the enum definition in `avdtp.h` and all references in `a2dp.c`
to use the correct spelling.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handling Previous Track and Next Track in this state
allowed mpl to dereference and advance track state,
then transition to Paused. This behavior contradicts
the MCS state model and causes failures.
Reject Next Track and Previous Track commands while
the Media Player is in the Inactive state. Handle
both opcodes like the other commands that are invalid
while the player is inactive.
Signed-off-by: Alex Ciascai <ext-alexandru.ciascai@nordicsemi.no>
Rename some struct fields from ase to ase_id[s] where
the value reflect an ASE ID. This is to avoid any confusion
with `struct bt_ascs_ase *ase` variables.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
`bt_bip_disconnect_rsp()` was incorrectly passing NULL instead of the
`buf` parameter to `bt_obex_disconnect_rsp()`. This prevented any
optional headers in the disconnect response from being sent. And
leading a result that the passed `buf` will not be released anymore.
Pass the `buf` parameter through to `bt_obex_disconnect_rsp()` so that
optional headers can be included in the disconnect response as
intended. And also the passed buffer `buf` will be managed by the
underlay if the OBEX disconnect response is sent without any errors
via the function `bt_obex_disconnect_rsp()`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The bt_bap_stream_qos() function validates ASE operations for all
streams in the unicast group, but it should only validate streams
that belong to the specified connection.
When a unicast group contains streams from multiple connections,
the current implementation incorrectly validates streams belonging
to other connections, which may cause false -EBADMSG errors if
those streams are in different states.
Add a connection check to skip streams that do not belong to the
specified connection during ASE operation validation.
Signed-off-by: Chang An <chang.an_1@nxp.com>
The A2DP code used a hardcoded `BT_A2DP_MAX_IE_LENGTH` of 8 bytes for
codec information elements. For the case that the received IE length
exceeds `BT_A2DP_MAX_IE_LENGTH`, the received data will be truncated
while the IE length is not reduced accordingly. It leads to the IE
length is inconsistency with the codec information elements. It may
lead to problems such as data accessing outside of bounds.
Replace the hardcoded constant with a new Kconfig option
`CONFIG_BT_A2DP_CODEC_MAX_IE_LEN` (default 8 bytes) that allows users
to configure the maximum codec IE length based on their needs. The
valid range is 4-253 bytes, where 4 is the minimum for mandatory SBC
codec and 253 is the maximum allowed by the LOSC length field.
Add validation checks to reject codec IEs that exceed the configured
maximum length, preventing buffer overflows. Remove the previous silent
truncation behavior that could lead to incorrect codec configurations.
Add assertions in `bt_a2dp_set_config_cb()` and
`bt_a2dp_stream_config_set_param()` to catch invalid IE lengths during
development. Add parameter validation in `bt_a2dp_stream_config()` and
`bt_a2dp_stream_reconfig()` to reject invalid configurations at
runtime.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Implement the HID Device profile core:
- L2CAP server registration for CTRL (PSM 0x0011) and
INTR (PSM 0x0013)
- Connection state machine
(DISCONNECTED -> CTRL -> INTR -> CONNECTED)
- Control channel message dispatch (GET_REPORT, SET_REPORT,
GET_PROTOCOL, SET_PROTOCOL, HID_CONTROL)
- Interrupt channel output report handling
- Handshake response generation based on handler return codes
- Virtual Cable Unplug, disconnecting once the PDU has been sent
- Buffer ownership: callee never frees caller-provided buf
- unregister returns -EBUSY if still connected
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Assisted-by: Claude Opus 4.6 (1M context)
Add internal header with HID protocol constants, message types,
handshake codes, header encoding macros, and session/device structures
per HID Profile v1.1.2.
Add HID-specific SDP attribute definitions (0x0200-0x0210) to the
public SDP header.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Assisted-by: Claude Opus 4.6 (1M context)
The mutex may not have been initialized when the
disconnected callback was called which would attempt to use it,
if bt_bap_scan_delegator_register was not called first.
Changed to use SYS_INIT to initialize the mutex and k_work.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The mutex may not have been initialized when the
disconnected callback was called which would attempt to use it,
if bt_mcs_init was not called first.
Changed to use SYS_INIT to initialize the mutex.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Rename the `configured` and `qos_set` callbacks of
`struct bt_bap_stream_ops` to `codec_configured` and `qos_configured`
respectively, so that the names align with the ASE state machine names
defined by the ASCS specification.
All in-tree users (host implementation, shell, samples and tests) have
been updated accordingly, including the local callback function names
that mirror the operation names.
Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The function accessed the instance without taking the mutex.
This also fixes the reporting time in the log from ticks to ms.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Header file include/zephyr/sys_clock.h is deprecated and will be removed
someday. Update the whole file tree to include zephyr/sys/clock.h
straight instead of zephyr/sys_clock.h.
This change was made running the sed shell command below:
$ sed -i 's/zephyr\/sys_clock\.h/zephyr\/sys\/clock\.h/' \
`grep -rsl "zephyr/sys_clock\.h" subsys/bluetooth/`
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
(cte_types & A) || (cte_types & B) is equivalent to
cte_types & (A | B). Collapse the BT_HCI_LE_AOD_CTE_RSP_1US / _2US test
into a single masked check. No change in behavior.
Signed-off-by: Flavio Ceolin <flavio@hubble.com>
(keys->flags & A) || (keys->flags & B) is equivalent to
keys->flags & (A | B). Collapse the BT_KEYS_OOB / BT_KEYS_SC test into a
single masked check.
Signed-off-by: Flavio Ceolin <flavio@hubble.com>
Some compilers would give the following warning:
subsys/bluetooth/audio/bap_broadcast_source.c:513:9:
warning: 'pd' may be used uninitialized [-Wmaybe-uninitialized]
513 | net_buf_simple_add_le24(buf, pd);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Even though the assignment `subgroup_count = 0U;`
and later check `if (subgroup_count == 0U) {` would
ensure that `pd = stream->ep->qos.pd;` is always performed.
Add a initialization of the variable to avoid any
warnings.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The encrypted Solicitation PDU is defined by Mesh Protocol 1.1.1
section 6.9.1 as a fixed 17-octet Network PDU (CTL=1, TTL=0, empty
TransportPDU, 8-octet NetMIC).
The mesh scan callback in adv.c restores its snapshot of the
advertising buffer before dispatching, so buf->len passed into
bt_mesh_sol_recv() may still cover trailing AD structures beyond the
Solicitation Service Data.
Trim buf->len to the expected 17 octets after consuming the
Solicitation Service Data Identification Type byte, and drop the PDU
early if fewer octets remain. This aligns the input handed to
sol_pdu_decrypt() with the specification.
The outer parsing loop is unaffected because the scan callback takes
its own net_buf_simple_save/restore snapshot around the dispatch.
Gated by CONFIG_BT_MESH_OD_PRIV_PROXY_SRV.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
If the stream has an endpoint associated with it from calling
bt_bap_stream_config but where this may have been rejected
by the peer, then the stream->ep will remain, but where the
state of the endpoint will be idle.
bt_bap_stream_release can be used to resetting this and
setting stream->ep to NULL.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
In the case that the function is called for e.g. a central and
CONFIG_BT_BAP_UNICAST_CLIENT=n, then it should not assert, as that
is possibly if the build supports both central and peripheral, but
only has CONFIG_BT_BAP_UNICAST_SERVER=y.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The release and disable operations did not use the function,
but instead had their own switches. Changes to use the
appropriate function.
Additionally modified some of the other calls so that they
appear more similar, and avoid unncessary `struct bt_bap_ep *ep`
variables but also add `struct bt_conn *conn;` variables to
avoid doing `stream->conn` more often than what is needed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Three argument parsers in bt.c silently ignored invalid or unknown
arguments, allowing the underlying operation to proceed as if no
bad input was given.
cmd_adv_start: the two keyword checks ("timeout", "num-events") were
written as independent if-blocks. An unknown argument (including
"--help") falls through both checks without error and advertising
starts. Convert to if/else-if/else and change fail_show_help to return
SHELL_CMD_HELP_PRINTED, consistent with the rest of the file.
cmd_per_adv_param: the expression (argc > 3 && !strcmp(argv[3],
"tx-power")) silently discards any other value for the fourth
argument. Split the condition so that a non-empty argv[3] that is not
"tx-power" is rejected with help.
cmd_fal_connect: the if/else-if chain for "on"/"off" had no else
branch; an unrecognised action fell through and returned 0 as if it
succeeded. Add an else branch that shows help and returns
SHELL_CMD_HELP_PRINTED.
Assisted-by: Claude:claude-sonnet-4.6
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If we fail to add any objects, then MCS would not work
correctly and would cause NULL pointer accesses thus
causing fatal errors.
Changed the error checking to asserts to catch this in
a more direct manner that is easier to debug, rather
than leaving MCS wrongly initiated and hope for no
runtime fatal errors later on.
Changed the check from media_proxy_pl_register to an assert
as it will always return 0 with the current implementation.
This is a workaround to handle the fatal error and instead
allow invalid behavior in MCS if there is a failure. A proper
fix should be done, but at the time of this commit, there are
another pending change that significantly refactors all this
code, and fixing the real issue before the refactor would
result in a massive re-write.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
If the is_cap boolean is set, the group was not automatically
deleted when all the streams were relased. CAP instead had
a different way of deleting the group, but in the case of
an error in CAP unicast start, that group was not deletable.
This change make it so that the user can always delete the unicast
group, as BAP or CAP, by releasing all the streams, regardless of
what procedures have failed or succeeded, or even been cancelled.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The `l2cap_br_retransmit_i_frames()` function was using
`atomic_test_and_set_bit()` to check and set the
`L2CAP_FLAG_RET_I_FRAMES` flag simultaneously. This caused the flag
to be set even when the outstanding PDU queue was empty, leading to
a state where the flag remained set without any frames to retransmit.
Fix the issue by only setting the flag `L2CAP_FLAG_RET_I_FRAMES`
after marking frames for retransmission, and only if there are
actually outstanding PDUs in the queue.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Currently, the VOCS client subscribes to characteristics by hardcoding
the CCC handle offset to attr->handle + 2. While common, this layout
is not strictly guaranteed by the Bluetooth specification and can fail
if a server structures its GATT table differently.
This commit updates the characteristic discovery callback to use the
CONFIG_BT_GATT_AUTO_DISCOVER_CCC feature to dynamically locate the CCC.
To support concurrent CCC discoveries safely, dedicated discovery
parameter structures are added to the VOCS client instance. This
prevents in-flight characteristic discoveries from clobbering each
other's memory state. Additionally, the auto-discovery boundary is
corrected to use the end of the service, rather than prematurely
shrinking to the characteristic value handle.
The hardcoded fallback and conditional compilation directives have
been removed, as VOCS inherently relies on CCC auto-discovery being
enabled via Kconfig.
Assisted-by: Gemini:gemini-3.1-pro
Fixeszephyrproject-rtos/zephyr#81132
Signed-off-by: Rupesh Kadam <rupesh.kadam1510@gmail.com>
