The state->pa_sync was not properly assigned a few places, causing
invalid behavior in the shell.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When calling bt_le_per_adv_sync_get_info we should not provide
information from the PA sync object if it is not longer valid.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove the _transport_type field from bt_map_mce_mas, bt_map_mce_mns,
bt_map_mse_mas, and bt_map_mse_mns structures.
Replace all usages of `_transport_type` with `goep.v2` to determine
whether the active transport is L2CAP (v2) or RFCOMM (v1), since this
information is already encoded in the GOEP instance after
BT_GOEP_INIT_V1/V2.
Signed-off-by: Can Wang <can.wang@nxp.com>
Return -ENODATA when the End of Body header is missing.
Previously, the code did not return an error when End of Body
was absent, which could cause the caller to treat the message as
valid. Fix this by returning `-ENODATA` in this case.
Signed-off-by: Can Wang <can.wang@nxp.com>
Add state validation check in the L2CAP BR/EDR receive path to ensure
channels are in a valid connected state before processing incoming
data.
The change adds a check after the fixed channel validation to verify
that the channel state is at least `BT_L2CAP_CONNECTED` before
proceeding with data reception. If the channel is in an earlier state
(`CONNECTING` or `DISCONNECTED`), an error is logged and the packet is
dropped.
It prevents potential issues from processing data on channels that
are not yet fully established or are in the process of being torn down,
improving the robustness of the L2CAP receive path.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Refactor the fixed channel accept functions to use channel state
for direct check if the channel is available instead of checking
`conn` field of channel. And also refactor the fixed channel
accept functions to use connection index for direct lookup instead
of iterating through the pool arrays.
The changes affect the L2CAP BR signaling channel, connectionless
channel, and SMP BR channel accept functions.
The functions now check if the channel is in the `DISCONNECTED`
state before accepting a new connection, returning `-EBUSY` if the
channel is not idle. This ensures proper channel state validation
and prevents reuse of channels that are still in use.
Additionally, instead of searching through the entire pool to find
an available channel context, the code now uses `bt_conn_index()` to
directly access the corresponding entry in the pool array.
The L2CAP BR fixed channel connection now also sets the channel
state to CONNECTING, ensuring proper state transitions.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add proper state management to Bluetooth Classic L2CAP fixed channel
connection by setting the channel state to `CONNECTED` before invoking
the connected callback.
The change ensures that fixed channels follow the same state
transition pattern as other L2CAP channel types. When a fixed channel
is connected, the state is now explicitly set to `BT_L2CAP_CONNECTED`
before calling the channel's connected callback.
The changes ensure the channel state accurately reflects its lifecycle
status.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Optimize the L2CAP BR/EDR dynamic CID allocation by using a static
counter to track the last allocated CID instead of always starting
from the beginning of the range.
The change introduces a br_cid_next array that maintains the position
of the next CID to allocate for each connection. The allocation now
searches from the last allocated position through the range, wrapping
around if needed. This reduces the search time for available CIDs in
scenarios with multiple active channels by avoiding repeated scans of
already-allocated CIDs at the start of the range.
Additionally, this modification has the advantage of preventing a
recently disconnected CID from being immediately reassigned to a new
channel. This avoids data from the channel disconnection process being
sent to the newly assigned channel.
The allocation still validates that CIDs are not in use by checking
against bt_l2cap_br_lookup_rx_cid() before assignment, maintaining the
same correctness guarantees as the previous implementation.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The connection pointer is already cleared by the L2CAP layer when the
channel is disconnected, so there's no need to manually set it to NULL
in the AVCTP disconnect callback.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The connection pointer is already cleared by the L2CAP layer when the
channel is disconnected, so there's no need to manually set it to NULL
in the AVDTP disconnect callback.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Refactor SDU (Service Data Unit) length tracking in Bluetooth Classic
L2CAP to use closure-based storage instead of channel state variables.
The change introduces a new l2cap_br_closure structure that extends
the base closure with an sdu_len field, allowing SDU length to be
stored per-buffer rather than in the channel structure. This eliminates
the need for _sdu_total_len tracking in both bt_l2cap_br_chan and
bt_l2cap_br_window structures.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add doxygen warnings to PBAP authentication helper functions to inform
users that PBAP v1.x uses MD5 for authentication, which is
cryptographically weak and provides limited security.
Add the log warnings to the function. The warning Log message will be
printed when the function is being called in the running time mode.
Also add a building warning if the `CONFIG_BT_PBAP` is enabled.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The HCI Set Extended Advertising Parameters command carries an
Advertising_TX_Power field, but Zephyr hardcoded it to
BT_HCI_LE_ADV_TX_POWER_NO_PREF, giving applications no way to
request a specific TX power for an extended advertising set.
Add an int8_t tx_power field to struct bt_le_adv_param together
with a new BT_LE_ADV_OPT_TX_POWER options bit. When the bit is set,
the tx_power value is passed to the controller via
le_ext_adv_param_set(). The controller selects the closest supported
level and reports the actual value back via bt_le_ext_adv_info.tx_power.
Existing code that does not set BT_LE_ADV_OPT_TX_POWER is unaffected;
the controller continues to choose the TX power freely.
Assisted-by: Augment:claude-sonnet-4.6
Signed-off-by: Sharon Lin <slin@atmosic.com>
Replace memcmp() with mbedtls_ct_memcmp() when verifying authentication
response digests to prevent timing attacks. The standard memcmp()
function may leak information about the digest through timing side
channels, allowing attackers to potentially recover the digest
byte-by-byte.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The per-adv-sync shell commands store the selected index for the
per_adv_syncs array. The select command validated and listed adv_sets
instead, so ARRAY_SIZE could select past per_adv_syncs or show unrelated
advertiser entries.
Return immediately when per-adv-sync transfer gets an out-of-range index.
Parse the optional index with shell_strtoul() so invalid input does not
fall through to the array access.
Signed-off-by: Old Ding <ai.neo.ae86@gmail.com>
The shell commands parse zero-based indexes and then use them directly as
array subscripts. Reject ARRAY_SIZE as well as larger values so the upper
bound cannot address one element past the array.
Signed-off-by: Old Ding <ai.neo.ae86@gmail.com>
Per documentation, the `module-str` variable used by the logging Kconfig
template should NOT contain strings, but instead the bare (unquoted)
name of the module.
Clean up Kconfig files in the Bluetooth subsystem which used quotes
where they shouldn't have, resulting in inconsistent option prompts
compared to all other logging options in tree.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
If notifications sent in the notify_cb function (system wq)
fails due to e.g. buffer issues, they are now retried, so that
it is ensure that the notification is sent.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Reorder the track_1_x and track_2_x entries so the longer track
set comes first and the segment navigation flow matches the
expected test sequence. Also change segment durations to be one
third of the track duration, so the segment layout scales with
the track data.
Signed-off-by: Alex Ciascai <alexandru.ciascai@nordicsemi.no>
Expose a new le_param_update_rejected callback in bt_conn_cb that is
invoked when a connection parameter update request is rejected, covering
both the HCI Connection Parameter Request (CPR) procedure and the L2CAP
Connection Parameter Update Procedure (CPUP) fallback.
The feature is gated by the new Kconfig option BT_USER_CONN_PARAM_REJECT.
When enabled, le_conn_update_complete() reports a rejection only for
application-initiated updates that finally failed, i.e. not while a
host-initiated (auto) update is still being retried and not for the
auto-initiated updates themselves, matching the documented scope of the
callback. The L2CAP fallback path reports a rejection using the synthetic
BT_HCI_ERR_L2CAP_CPUP_REJECTED (0xFF) code so applications can distinguish
an L2CAP fallback rejection from a real HCI CPR rejection error code.
As part of this, le_param_updated() is no longer called when an update
fails (previously it was called unconditionally, reporting the unchanged
parameters with no error indication). This behaviour change is documented
in the migration guide.
Add release note and migration guide entries and a bsim test under
tests/bsim/bluetooth/host/misc/conn_param_update_reject that exercises both
the application-initiated rejection path and that a rejected host-initiated
(auto) update does not trigger the callback.
Signed-off-by: Sharon Lin <slin@atmosic.com>
Replace nested MIN/MAX macro calls with the min3/max3 APIs which are
safer (evaluate arguments only once) and cleaner.
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Add a new API bt_le_per_adv_update_did() that sends the
LE Set Periodic Advertising Data HCI command with operation
set to 0x04 (Unchanged Data). This instructs the controller
to update only the Advertising Data Identifier (DID) in the
ADI field without modifying the advertising data payload.
This is useful when the application wants to signal to
scanners that the periodic advertising train has new
information available (via DID change) without actually
changing the data content.
Also add a corresponding shell command 'per-adv-update-did'
for testing purposes.
Signed-off-by: Zihao Gao <gaozihao@xiaomi.com>
Assisted-by: Kiro:claude-opus-4.6
The text states that the minimum is 1, but it is possible to
set the value to 0 even when CONFIG_BT_SMP=y.
This commit changes this so that the option and text matches.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Remove Source_Address_Type from the receive state matching criteria in
find_recv_state_by_sink_fields_cb(). In privacy scenarios, a Broadcast
Source may advertise using a resolvable private address (RPA) or an
address type that differs from what the BASS client originally wrote.
The previous address type comparison caused the lookup to fail, preventing
the sink from ever attempting PA synchronization with a valid source.
Per BASS 3.1.1.4, the server identifies the Broadcast Source to
synchronize with by comparing Adv_SID (from ADV_EXT_IND) and
Broadcast_ID (from AUX_ADV_IND) only. Address type is not part of
the identification criteria.
Signed-off-by: Yago Fontoura do Rosario <yafo@demant.com>
Change the BAP roles to require
BT_AUDIO_CODEC_CFG_MAX_DATA_SIZE to be at least 19.
This is the minimal amount of cfg data required to support LC3,
which is mandated by BAP.
Adding this requirement should not really affect any existing
applications, given that it was the default.
Adding this requirement allows us to remove a bunch of guards
since we can rely on Kconfig to ensure it's non-0.
BT_AUDIO_CODEC_CFG_MAX_DATA_SIZE may still be set to a lower value
in case the audio API is used without BAP.
ASCS can technically be used without BAP, but currently it is very
tied to BAP and thus the requirement was also added for ASCS until
the BAP depdenency is changed in the future.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The `thread` field is not initialized, if it's being animated via
k_work_queue_run instead of k_work_queue_start.
Signed-off-by: Michael Zimmermann <michael.zimmermann@sevenlab.de>
Compare the actual values of the codec configuration
or qos configuration when in the codec configured state,
the QoS configured state or the enabling state.
In the case that the stream is one of the these states
and the parameters to set differ from what is already there,
the appropriate actions should be taken to set the right
values, even if it does not mean an actual state change.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit fixes 2 bugs:
1) Bad/missing err return from bt_bap_stream_reconfig
2) Missing handle of codec_cfg fields that are not part of the
ASCS notifcations: path_id, ctlr_transcode, target_latency and
target_phy.
To be able to set these, we need to store them somewhere, and it
makes sense to attach the ep->codec_cfg earlier so that we can store
them in there.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Instead of using the "regular" BAP codec capabilities for GMAP,
`gmap init` will now register its own capabilities.
This makes it more clear that for the gaming context we only
support the frequencies and frame sizes defined by GMAP
(e.g. no 8KHz for gaming audio, or 155 frame sizes).
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Use the unicast_to_broadcast_created callback to properly handle
the creation and potentional deletion of the broadcast source.
Additionally since this exposes the broadcast source before
the procedure is completed, additional checks for whether
the handover is in progress has been added.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
MISRRA 14.2 does not allow modifying the iterator inside
for loops. Modify the loops to while where appropriate
and add or modify additional checks for length before
incrementing the iterator.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit fixes 2 things:
1) If an advertising set is not enabled, the rpa_expired callback
is no longer called. Since we pause the adv set to update the RPA
we need to use BT_ADV_RPA_UPDATE instead of BT_ADV_ENABLED to check
whether it is "active".
2) If we do not have an active advertising set, not scanning or
not initiating a connection, the RPA timer is stopped. The
timer is started again whenever any action that uses RPA is
started again.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Providing a number of objects as decimal (e.g. 48) is
more intuitive than hex (e.g. 0x30) for humans.
Additionally the max number of objects when the directory
listing object is support has also been changed to more
accurate depict the actual maximal number of objects based on
CONFIG_BT_OTS_OBJ_MAX_NAME_LEN instead of using the absolute
max value. Since Kconfig does not support such calculations,
this maximum has been moved to a BUILD_ASSERT.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The command did not count correctly in the unicast_streams
array, and the number of streams support did not match the
audio configuration.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
When a stream that is currently being used for incoming
data and sends that data to the USB host disconnects or
otherwise stops, we now clear any data that may be stored
for that stream.
The reason for this is that if another stream takes it place
we should start from a clean slate to avoid any issues with
mixing audio data.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Move PACS out from CONFIG_BT_BAP_UNICAST_SERVER as the broadcast
sink shall also register PACS.
Modified the code for PACS a bit to clean it up and collect it in
one place.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The gmap_reset function also reset the gmap_cli->flags
which made the atomic_test_and_set_bit for
GMAP_CLIENT_FLAG_BUSY useless.
Modified the reset function to not clear that flag.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Move the ECDH P-256 key generation during mesh provisioning from the
system workqueue to the dedicated long workqueue (bt_long_wq). The ECDH
computation can take several seconds on platforms with software ECC,
blocking all other system workqueue users for the duration.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
Move the long workqueue implementation (long_wq.c, long_wq.h) and its
Kconfig options from subsys/bluetooth/host/ to subsys/bluetooth/common/.
This makes the dedicated workqueue API available to other Bluetooth
subsystems beyond the host, such as Bluetooth Mesh, without relying on
internal host headers.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
Fix the 'l2cap metrics' command argument definition.
It accepts a single parameter ("metrics") to print throughput,
but was incorrectly set to require two arguments, preventing output.
Update SHELL_CMD_ARG to min=1 and max=1 to allow enabling,
disabling, and printing throughput metrics.
Signed-off-by: Sohan Kumar <sohan.kumar@nxp.com>
If we had a bond with a device and the flags were non-zero,
and we power cycled but where bt_has_register was not called
before the bonded device reconnected then in the
security_changed we would call notify_work_reschedule which
would then notify_work_handler would access uninitialized values
like hearing_aid_features_attr or the other attributes (they would
be NULL), causing an assert when calling bt_gatt_is_subscribed.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Add a specific check for getting the broadcast streaming
context, and log the individual values for unicast and
broadcast if they differ.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
