When received the valid S frame, the retransmission timer should not
be restarted if unacknowledged I-frames have been sent but the
retransmission timer has not elapsed.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When the returned buffer is a `NULL` of the pull function, it means
there is not any data needs to be sent. However maybe there is any
frame pending on other L2CAP channel needs to be sent over the same
ACL connection.
Re-trigger the TX processor. It will call the pull function again
and the pending buffer will be pulled from following L2CAP.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The current logic will result in rsp always being accept because LOSC
added is 0. and according to the spec, LOSC should not be added to the
Set Configuration Reject response.
Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
When peer monitor and retransmission timeout are zero, set them to the
default values. This ensures that the monitor timeout is always a valid
value to avoid the L2CAP BR timer work queue hang.
Signed-off-by: Make Shi <make.shi@nxp.com>
Remove duplicated check for 'ep->stream == NULL' to clean up conditionals
and avoid unnecessary repeated evaluations.
This cleans up the code and avoids unnecessary repeated condition
evaluation.
Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
Channel tx_queue purging on disconnect was inconsistently handled
by the different channels: iso, l2cap, l2cap_br.
iso channels handled purging in the tx_data_pull hook.
l2cap and l2cap_br did the purging in channel delete functions
and did not expect tx_data_pull to be called for a disconnected
channel. Their data_pull functions could return a ptr to a
net_buf that was still on the tx_queue, which is problematic
when the conn tx_processor unrefs the returned buffer resulting
in multiple calls to the buf destroy function.
To make things consistent and correct, remove the code that tries
to purge tx_queues in the tx_processor and only do purging in
the channels themselves when they are deleted/disconnected.
Also refactor and clarify referencing of the net_buf returned
by tx_data_pull. It was confusing who had a reference and
when, which could vary depending on the length of the original
buffer. There are three cases: the buffer length is less
than the tx.mps, greater the mps but less than the mtu so
requiring segementation but not fragmentation, or greater than
both mps and mtu so requiring both segmentation and fragmentation.
The conn layer would increase the refcnt if the length was
greater than the mtu, but not have any awareness of whether
the net_buf was still on the tx_queue or not.
Now it is the tx_data_pull callbacks responsibitity to increment
the reference count if it is returning a pointer to a net_buf
that it is still keeping on the tx_queue for segmentation purposes.
The conn layer will now always transfer that reference into a
fragment view and not conditional it on the length relative to
the mtu, and always decrement the reference to the parent when
the fragment is destroyed.
So there is no risk of decrementing a reference to a net buf
that might still be on a tx_queue, which simplifies error
handling in particular.
Also add error handling paths for when asserts are not enabled.
Signed-off-by: Mike J. Chen <mjchen@google.com>
In HFP PTS, cases run fail with the log 'Bluetooth Profile Descriptor
List UUID (0x111E) is missing'.
With this patch, the affected cases can pass correctly.
Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
SonarQube reports: cast from 'const struct _snode *' to 'struct _snode *'
drops const qualifier. Fix it by removing the const.
Signed-off-by: Mark Wang <yichang.wang@nxp.com>
(cherry picked from commit 7982ee0df13b7f9e54595f799e32f38c464b0f9e)
1. bt_sdp_discover may be called in two tasks at the same time:
(1) If the 2 calls are for 2 acl conns,
the same session may be new allocated to two acl conns.
(2) If the 2 calls are for the same acl conn, the same session should be
used.
Use the bt_conn_index to map acl conn with session to fix it.
2. fix that bt_sdp_discover may use one session that is disconnecting,
put req to reqs_next and process it after disconnected.
3. remove memset of session, reset each members individually.
Signed-off-by: Mark Wang <yichang.wang@nxp.com>
(cherry picked from commit dcbe5d7dc5d72ce0d2915cf2b291cc84a916a536)
Ensure that the BR/EDR L2CAP RX MTU is limited to the configured
BT_L2CAP_RX_MTU value during channel configuration.
This change prevent potential buffer overflow issues when receiving
data larger than the configured buffer size.
Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
The MTU calculation in rfcomm_connected() was incorrectly adding the FCS
size instead of subtracting it.
This could lead to buffer overflows when sending data that exceeds
the actual available space.
Fix the calculation by properly subtracting both the RFCOMM header size and
the FCS size from the L2CAP MTU to get the correct RFCOMM session MTU.
Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
There is an issue that the SCO connect cannot be un-referenced by HFP
AG when the SCO connection is broken if the SCO connect is not created
by HFP AG.
Register SCO connect change callback. And un-reference the SCO connect
in SCO disconnected callback.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
There are two issues found,
Issue 1, if the SCO connection has been established, the SCO connected
event will not be notified. Then the call that waiting for the SCO
connected event will not be updated. And the call will be rejected due
to the timeout.
Issue 2, the SCO con object will be cleared when SLC is disconnecting
and the SCO connection has been established. It causes the SCO connect
object will be `NULL` in the SCO disconnected callback.
Add a new field `sco_conn` to keep the SCO connect object. Manage the
SCO connection via the field `ag->sco_conn`.
When creating the SCO connection, keep the created SCO connect object
to `ag->sco_conn`. And if the `ag->sco_chan.sco` is `NULL`, it means
the SCO connection has been established. Just update the call that
waiting for the SCO connected event directly.
Increase the `ref` of SCO connect object and pass to the field
`ag->sco_conn` if the `ag->sco_conn` is `NULL`.
Decrease the `ref` of SCO connect object if the `ag->sco_conn` is not
`NULL` when disconnect the SCO connection or process SCO disconnected
event.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
In the function `sdp_client_ss_search()` and
`sdp_client_ssa_search()`, the allocated buf is not released if the
required UUID is invalid.
Un-reference the allocated net buffer if the UUID is invalid.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The `session->param` should be updated to date whatever the function
`sdp_client_ssa_search()`, `sdp_client_sa_search()` or
`sdp_client_ss_search()` can be executed properly.
Update the `session->param` to the new `param` when executing the
function.
Fixes#91156
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
There is a potential issue that the index of ACL may out of the
bounds of the array `bt_hfp_hf_pool` if the array size is not aligned
with the array size of `acl_conns`.
To avoid the potential issue, check if the ACL conn index is less than
the array size of `bt_hfp_hf_pool` before accessing the array
`bt_hfp_hf_pool` with ACL conn index.
Fixes#91172
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
- Remove memset on bt_l2cap_br_chan during SDP
disconnect to prevent overwriting resources
(e.g., rtx_work) still in use by L2CAP,
which handles channel cleanup itself.
- Delete unused partial_resp_queue to clean up code.
Signed-off-by: ZhongYao Luo <LuoZhongYao@gmail.com>
If the received data length is less than 2 in none basic mode, the
L2CAP channel connection will be dropped.
Only check the received data length if the `SAR` is
`BT_L2CAP_CONTROL_SAR_START`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support zero-length SDU sending if the L2CAP channel connection is not
in basic mode.
Flag the zero-length SDU buffer and clear it if it has been processed.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handle the ECHO request/response of classic L2CAP signaling packets.
Add the functions `bt_l2cap_br_echo_cb_register()` and
`bt_l2cap_br_echo_cb_unregister()` to register/unregister the ECHO
callbacks to monitor the ECHO REQ and RSP.
Add the function `bt_l2cap_br_echo_req()` to send the ECHO REQ through
classic L2CAP signaling channel.
Add the function `bt_l2cap_br_echo_rsp()` to reply the ECHO REQ
through the classic L2CAP signaling channel.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Disconnect the L2CAP channel connection if the proposed MTU is less
than min MTU or more than local supported MTU.
The main scenes are as follows.
If the proposed MTU is less than MIN MTU.
1. The channel connection of client and server is established,
2. Client/server sends channel config REQ (MTU=50),
3. Peer replies channel config RQP (Unaccepted/success with MTU=30),
4. The client/server will repeat step 3~4 if the RSP is unacceptable.
With the change applied, the local will disconnect the L2CAP channel
connection in step 3.
If the proposed MTU is more than local supported MTU.
1. The channel connection of client and server is established,
2. Client/server sends channel config REQ (MTU=50),
3. Peer replies channel config RQP (Unaccepted/success with MTU=80),
4. The client/server will repeat step 3~4 if the RSP is unacceptable.
With the change applied, the local will disconnect the L2CAP channel
connection in step 3.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Change the callback `get_ongoing_call()` of the AG from synchronous to
asynchronous mode. It will help to avoid the Bluetooth host stack be
blocked in the context of callback `get_ongoing_call()`.
Add a function `bt_hfp_ag_ongoing_calls()` to set the ongoing calls and
reply the AT command `AT+CIND?` after the callback `get_ongoing_call()`
has been notified.
Add a delayable worker to avoid the AT command `AT+CIND?` never being
replied. After the time exceeds
@kconfig{CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT}, the response of
the AT command `AT+CIND?` will be replied.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
If the any value of Call, Call Setup, and Held Call indicators is not
zero in the response of `AT+CIND?`, get all calls via `AT+CLCC`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
For read-only access to fields, `lock/unlock` is unnecessary.
Remove unnecessary `lock/unlock` protection for read-only access
fields of AG.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support the case that there are some calls existed before SLC
established.
Add a callback to get the ongoing calls one by one from upper layer
when the response of the AT command `AT+CIND=?` from HF has been sent.
And set the Call, Call Setup, and Held Call indicators and report the
values int the response of AT command `AT+CIND?`. Then report all
ongoing calls in the `+CLCC` response.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The CR bit in DISC frames should be set as a command rather than a
response.
This patch fixes the rfcomm_send_disc function to correctly use
BT_RFCOMM_CMD_CR instead of BT_RFCOMM_RESP_CR when setting the CR bit in
the address field of DISC frames.
Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
In current implementation, if the MITM flag of both sides is disabled,
the pairing method is incorrect.
Such as, the IOCAP of both sides is `display_yesorno`, the pairing
method is `PASSKEY_CONFIRM`. But actually, it should be `JUST_WORKS`
in this case.
Fix the issue by setting the pairing method to `JUST_WORKS` if the
MITM flag of both sides is false.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
After https://github.com/zephyrproject-rtos/zephyr/pull/72090,
`conn_tx_alloc` no longer blocks, and each buffer always has a
corresponding `bt_conn_tx` object. This eliminates the need to configure
the number of `bt_conn_tx` objects via `CONFIG_BT_CONN_TX_MAX`, since
every buffer now carries its own context even when no callback is used.
This commit deprecates `CONFIG_BT_CONN_TX_MAX` as it is no longer
necessary. Instead, `CONFIG_BT_BUF_ACL_TX_COUNT` is used to allocate
`bt_conn_tx` objects for outgoing ACL data. ZLL already uses
`CONFIG_BT_BUF_ACL_TX_COUNT` to configure the number of outgoing ACL
packets. With this change, modifying the packet count will automatically
adjust the number of corresponding contexts, preventing both context
starvatoin and underutilization.
This approach also aligns with ISO, where the number of `bt_conn_tx`
objects for outgoing ISOdata matches `CONFIG_BT_ISO_TX_BUF_COUNT`.
Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
When the L2CAP channel connection is in none basic mode, the
`seg_recv` cannot work properly if the configuration
`CONFIG_BT_L2CAP_SEG_RECV` is enabled. And the L2CAP channel
connection will be broken incorrectly.
Check whether the received data len exceeds the SDU length if the
`SAR` is `BT_L2CAP_CONTROL_SAR_END` or `BT_L2CAP_CONTROL_SAR_CONTI`.
And check whether the SDU length is valid if the `SAR` is
`BT_L2CAP_CONTROL_SAR_UNSEG` or `BT_L2CAP_CONTROL_SAR_START`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The response L2CAP_COMMAND_REJECT_RSP(BT_L2CAP_REJ_NOT_UNDERSTOOD)
should be replied if the received L2CAP command is a invalid L2CAP
signaling command packets with extra data in the Information Payload.
Send L2CAP_COMMAND_REJECT_RSP(BT_L2CAP_REJ_NOT_UNDERSTOOD) if it a
small L2CAP signaling PDU or it has short length.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add support for Remote Port Negotiation (RPN) commands in the RFCOMM.
This allows applications to configure the serial port parameters
over RFCOMM connections, such as baud rate, data bits, stop bits, parity
and flow control.
Changes include:
- Add enumerations for RPN parameters (baud rate, data bits, stop bits,
parity)
- Add a public API function bt_rfcomm_send_rpn_cmd() to send RPN
commands
- Add shell command to test RPN with default parameters
This functionality is required by certain Bluetooth profiles that use
RFCOMM and need to configure serial port parameters.
Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
In retransmission mode and flow control mode, the TxWindow size should
be same on both sides.
When one side is updated, also update the other side.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
A bonding issue is found with following conditions,
a. Local is a SSP initiator and it is in non-bondable mode,
b. Peer is in bondable mode,
c. The bonding flag in Authentication_Requirements of local IOCAP is
`No Bonding`,
d. the bonding flag in Authentication_Requirements of peer IOCAP is
`Bonding`.
The bonding information will be exchanged and stored. It is incorrect
behavior.
Fix the issue by reporting a pairing failure and disconnecting the ACL
connection with error `BT_HCI_ERR_AUTH_FAIL`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The FCS flag of TX direction is not set correctly if the FCS flag of
RX direction is set. The issue could be found with following steps,
Step 1, Local sends configuration request with ERET mode and FCS
omitted.
Step 2, Peer replies the configuration response without any errors.
Step 3, Peer sends configuration request with ERET mode and NO FCS.
Step 4, Local replies the configuration response without any errors.
The FCS flag of TX is cleared incorrectly.
The FCS should be enabled if any one side enables the FCS.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
In current implementation, if the HCI ACL data length exceeds on L2CAP
packet, the HCI ACL data will be discarded.
Support the case if the transport is classic.
Add a function `bt_br_acl_recv()` to handle the multi L2CAP packets
one by one.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When the connection status is "PENDING", need reset the br channel
identifier to the correct value before resend the connection response,
otherwise these is in an "ident mismatch" error being reported.
Signed-off-by: Make Shi <make.shi@nxp.com>
