Now that we properly destroy the tx context in `bt_conn_process_tx`, we
need to make sure the context is really valid.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Symptoms were that a disconnect happening when a buffer was enqueued but
not sent resulted in a meta-data memory leak.
This is problematic because it seemed (as per the OP) that it resulted in
the whole host getting locked up when a device sending long L2CAP packets
was prone to disconnect-reconnect cycles (e.g. in a bad RF environment).
Fixes#47649
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
The expression for the condition for using host-based RPA resolution now
simplifies to "Use host-based when we need to resolve more identities
than the controller can handle.".
Proof:
X=((bt_dev.le.rl_entries > 0) && (!bt_dev.le.rl_size ||
bt_dev.le.rl_entries > bt_dev.le.rl_size))
X=(a > 0) && (!b || a > b)
a>=0, b>=0, because they are cardinal / size_t.
If a=0:
// X evaluates to false. (0 > b)=(a > b) also always evaluates to false.
X=false=(0 > b)=(a > b)
If a>0:
X=(!b || a > b)
If b=0: X=true=(a > 0)=(a > b)
If b>0: X=(false || (a > b))=(a > b)
The expression is equivalent with (a > b) for all values of (a,b).
QED.
Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
Mesh Profile Specification errata 11310
Section 4.4.4.1
"This model shall support model publication, as defined in Section
4.2.2 of the Mesh Profile specification and model subscription,
as defined in section 4.2.3 of the Mesh Profile specification."
Signed-off-by: Michal Narajowski <michal.narajowski@codecoup.pl>
The mandatory minimum PDU length conformance test was failing
because the LLCP did update the effective rx/tx times (and
corresponding notification to host).
This was due to a missing test condition.
This PR adds the missing conditions.
Note that with this change the refactored controller code is
similar to the legacy code; relevant code is in ull_conn.c,
in the function event_phy_upd_ind_prep
Signed-off-by: Andries Kruithof <andries.kruithof@nordicsemi.no>
Secure Connection Only mode requires use of LE Security mode 1 level 4
which mandates 128 encryption key size.
Defaults in Kconfig are set from top-to-bottom and this resulted in
7 bytes key being forced. What is worse, user cannot override this
from prj.conf file since BT_SMP_MIN_ENC_KEY_SIZE is hidden config
if BT_SMP_SC_ONLY is enabled.
Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
This fixes issue where the ASE state stuck in Releasing state instead of
going to Idle/Codec Configured as test requires.
Looks like there was a race condition possible where the ASE
notification work was run before the stream was detached, so there was
no transition to idle state triggered.
Fixes: ASCS/SR/ACP/BV-24-C
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
The server should not perform Release operation on ASE in Releasing
state. This fixes crash that might happen in ASCS when ACL gets
disconnected while ASE is in Releasing state so that server tries to
dereference NULL stream.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
Add support in Bluetooth Host to enable Periodic Advertising
ADI support feature when supported in the Controller to
include ADI in Periodic Advertising AUX_SYNC_IND PDU.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
According Mesh Spec 1.0.1:
Upon receiving and successfully authenticating to
Secure Network beacon for a primary subnet whose
IV Index is 1 or more higher than the current known IV
Index, the node shall set its current IV Index and its
current IV Update procedure state from the values in
this Secure Network beacon.
Look like test_iv_index.c:81
``` C
(bt_mesh_net_iv_update(TEST_IV_IDX + 1, BCN_IV_IN_IDLE));
```
This test case already exists, but the wrong testcase
to test wrong code.
Move `is_iv_recovery` into `bt_mesh_net_iv_update`.
First check whether it is IV recovery, and then carry out
the subsequent IV normal update procedure.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
Fix redundant node rx reservation when receiving Periodic
Advertising Sync chain PDUs. Only the reception of first
pdu in chain, AUX_SYNC_IND PDU, needs extra node rx
reservation to be allocated for generation of incomplete
data status in case of incomplete reception of chain PDUs.
Co-authored-by: Piotr Pryga <piotr.pryga@nordicsemi.no>
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Fix hang on chain PDU allocation by replacing K_FOREVER use
by a timeout. Hang occurs when configured number of
advertising data buffers is low.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
PHY update control procedure has to send a notification towards
Host when the PHY is actually changed, when the instant happens.
Control procedures are handled in a prepare phase of a connection
event, hence notifications are send towards host to early.
The fix for that is to postpone send of a notification.
New state has been introduced to remote requested PHY update
control procedure: RP_PU_STATE_WAIT_INSTANT_ON_AIR.
Also new event has been introduced: RP_PU_EVT_NTF, that is used
to inform the PHY update state machine that notification may
be send.
There are two places where the notification events may be generated
ull_conn_rx, just before first received PDU is send towards Host
or ull_conn_done, in case there were no PDU received.
Signed-off-by: Piotr Pryga <piotr.pryga@nordicsemi.no>
If the device was not paired, the conn->le.keys is NULL, so
conn->le.keys will cause NULL pointer dereference.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
Starting the pasive scanner so host can resolve addresses
shouldn't be nessesary when the resolving list is empty.
Signed-off-by: Martin Tverdal <martin.tverdal@nordicsemi.no>
The `name` parameter is redundant, as the `name` and `name-ad` options are
available already as `adv-create` and `adv-param` command parameters.
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
Change doc of CONFIG_BT_PRIVACY to explicitly say it's needed for both
generating and resolving RPAs.
Disable host-based RPA resolution in `bt_conn_le_create` when
!CONFIG_BT_PRIVACY.
Update doc of `bt_conn_le_create` to document that CONFIG_BT_PRIVACY is
a requirement for resolving RPAs. Also explictly say that this function
will resolve private identities. Also explain the expected effect of
Network Privacy on this function.
Reduce coupling to `bt_le_create_conn_ext` and
`bt_le_create_conn_legacy` in `bt_conn_le_create` by just use
`resp_addr` when it's set, instead of "knowing" when it had been set.
The alternative would be to also update `bt_le_create_conn_ext` and
`bt_le_create_conn_legacy` to have `(IS_ENABLED(CONFIG_BT_PRIVACY) &&
(!bt_dev.le.rl_size || bt_dev.le.rl_entries > bt_dev.le.rl_size))`
Signed-off-by: Aleksander Wasaznik <aleksander.wasaznik@nordicsemi.no>
The unicast client will now read the PACS location value
during the discovery procedure, as well as subscribing to
it.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The code in unicast_client.c was guarded by
CONFIG_BT_AUDIO_UNICAST_CLIENT but the file is only
compiled if CONFIG_BT_AUDIO_UNICAST_CLIENT is enabled.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Rename the cache from "cache" to "pac_cache" to avoid
name clashes with local cache variables.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Added possibility to enforce that a LE Secure Connection is required
for reading and writing characteristics, i.e. providing a more fine
grained check that allows services that requires secure connection
to co-exists with those that doesn't.
Signed-off-by: Lars Knudsen <larsgk@gmail.com>
Signed-off-by: Fredrik Danebjer <fredrik@danebjer.com>
Extend the `vcs init` command with optional parameters to set the
initial VCS state including volume level, mute state and step size.
This is needed to pass qualification test cases listed below:
VCS/SR/CP/BV-01-C,
VCS/SR/CP/BV-02-C,
VCS/SR/CP/BV-02-C,
VCS/SR/CP/BV-04-C
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
Shell command "bt init sync" now correctly enables Bluetooth
synchronously, and "bt init" enables Bluetooth asynchronously.
Fixes#47860.
Signed-off-by: Andreas Rudolf <andreas.rudolf@husqvarnagroup.com>
The sys_snode_t nodes are used internally, and we use the
convention of the "_" prefix to indicate that this is
an internally used value.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modify the broadcast sink to use a list of streams instead
of an array. This removes the requirement that the array
of stream pointers shall be static, and makes the
broadcast sink API and implementation more similar
to the unicast group and broadcast source.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Modify from array to list. The list approach is easily
implemented as it is used for the unicast groups, and
using the list approach instead of an array does not
require the array to be static.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Any project with Kconfig option CONFIG_LEGACY_INCLUDE_PATH set to n
couldn't be built because some files were missing zephyr/ prefix in
includes
Re-run the migrate_includes.py script to fix all legacy include paths
Signed-off-by: Tomislav Milkovic <milkovic@byte-lab.com>
This fixes bt_pacs_context_available so that it gets available
contexts from capabilities that hold the value.
This removes redundant available_context that were held
(and not updated) in pacs.c.
Fixes: HAP/HA/STR/BV-01-C
Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This API now becomes a low-level API, in the sense that it should only be
used if the app developer knows what he is doing and wants to ensure a
ATT_MULTIPLE_HANDLE_VALUE_NTF PDU goes on-air.
For the other 99% of use cases, `bt_gatt_notify` should instead be used, as
it will automatically upgrade to ATT_MULTIPLE_HANDLE_VALUE_NTF when
possible.
One can disable the batching of notifications when using `bt_gatt_notify`
by setting CONFIG_BT_GATT_NOTIFY_MULTIPLE_FLUSH_MS=0 .
This API doesn't support lookup by UUID any more.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
In the case a call to `bt_gatt_notify_cb` gets its attribute data
batched with others to form an ATT_MULTIPLE_HANDLE_VALUE_NTF PDU, the
application developer would still expect one callback per API call.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Sending ATT_MULTIPLE_HANDLE_VALUE_NTF containing only one handle doesn't
seem forbidden by the spec, but peers might find it unexpected.
This change morphs a ATT_MULTIPLE_HANDLE_VALUE_NTF into a
ATT_HANDLE_VALUE_NTF right before sending it, if it detects this
condition.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
The intended behavior is that calling `gatt_notify_mult` in a loop will
result in a `BT_ATT_OP_NOTIFY_MULT` containing all the handles and their
data.
What was happening instead is that the caller thread was a lower priority
than the system workqueue, and thus multiple `BT_ATT_OP_NOTIFY_MULT` PDUs
were being sent over the air instead of one.
Submitting the work item with a delay side-steps this particular issue.
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
`bt_gatt_unsubscribe` was pending a write to the CCC and then immediately
canceling it.
Fixes#47682 .
Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
This fixes an issue where IV index stage counting timer is not
started after the node is provisioned. This would have prevented node
from performing IV index updates.
Signed-off-by: Omkar Kulkarni <omkar.kulkarni@nordicsemi.no>
This change makes the optional procedures in the TBS Client optional
and configurable through Kconfig.
Signed-off-by: Fredrik Danebjer <fredrik@danebjer.com>
Mayfly by design uses a memq for storage of its jobs. The memq
requires head and tail to track the content. It is considered
empty is head equals tail.
When memq instance is initialized then there is a new link
instance stored in head and tail, nevertheless the memq is
still empty.
When new job is enqueued to a memq, the inilial link is used
to store the job. New link, provided by enqueue call, is stored
in the tail for future enqueue.
When enqueued job was served and is dequeued, the link it was
assigned to is returned and stored in the job object.
That link will be used in future for call to enqueue.
Now lets consider a situation when we are just after initalization.
Some default initial link is in empty memq. We enqueue and dequeue
a job. After dequeue, the job object stores the initial link object.
The one that was put into the memq during initialization.
Next Bluetooth stack is disabled and enabled again.
The job is enqueued again, but it still stores the initial link
address. After enqueue the memq head points to initial link object,
that stores new job. Tail points to link deliveded by enqueue call,
that is also the initial link object. The memq is considered to be
empty, nevertheless there was a successful enqueue operation.
The issue is casued by lack of re-initialization of a job object
on init. In most cases these objects are static members of some
functions, hence there is no re-initialization after bt_disable
and bt_enable calls.
The problem is fixed by re-initialization of mayfly only once
on bt_enable() call. Then it doesn't matter what links are stored
in dequeued objects and there is no need to re-initialized mayfly
job objects.
Signed-off-by: Piotr Pryga <piotr.pryga@nordicsemi.no>
The problem is visible after call to bt_disable when there was
a connection. On a next bt_enable call when hc_tx_thread starts
it is possible that the conn_change object internals are not
re-initialized entirely and the function fails during k_poll call.
The commit changes explicit assignment conn_change object to
a k_poll_signal_init that does proper initialization.
Signed-off-by: Piotr Pryga <piotr.pryga@nordicsemi.no>
While execution of bt_disable there is missing de-initialization
of per_adv_sync_pool. If there was a sync in progress, (flags set
to BT_PER_ADV_SYNC_SYNCING) before bt_disable, then when the stack
is re-enabled by bt_enable new sync create fails.
The commit fixes the issue by new function that clears flags for
all per_adv_sync_pool entries. The function is executed by bt_disable.
Signed-off-by: Piotr Pryga <piotr.pryga@nordicsemi.no>
Struct bt_mesh_send_cb.end is called from the mesh advertiser thread.
bt_mesh_reset now requires more stack size, thus can't be called from
the advertiser thread. k_work instance requires less memory than needed
for bt_mesh_reset.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
Upon bt_mesh_reset call, all mesh modules has to clear the privisioning
and configuration data. None of the modules store or erase in settings
subsystem immediately, but put this on the mesh settings work. After the
settings work is scheduled, all stored data will be removed and the
device will eventually be unprovisioned. Until then, the device is not
completely unprovisioned, thus calling bt_mesh_prov_enable,
bt_mesh_provision (and bt_mesh_cdb_create) should not be allowed.
Struct bt_mesh_prov has a reset callback stating that after this
callback is called, the device has been reset and can be re-provisioned
again. Also, bt_mesh_reset API description states that after calling
bt_mesh_reset API, the device needs to reenable the provisioning layer
to be provisioned again. But this is not correct since the settings has
to be cleared before the device can be reprovisionined.
This commit makes bt_mesh_reset flush pending settings so that the
device can be reprovisioned immediately and the API will behave as
written in the description.
The same applies to bt_mesh_cdb_clear.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
