Commit Graph

9610 Commits

Author SHA1 Message Date
Lyle Zhu
af42036ca6 Bluetooth: Classic: SDP: Improve UUID 128 support
In current implementation, the UUID 128 is not well supported. The
found issue includes,
Issue 1: No clear byte order of the UUID 128 in local SDP record.
Issue 2: No clear byte order of the UUID 128 of the SDP discover
parameter.

For issue 1,
Add the description to note that if the SDP attribute type is
`BT_SDP_UINT128`, `BT_SDP_INT128`, and `BT_SDP_UUID128`, the byte
order should be little-endian.

And swap the 128bit from little-endian to big-endian when responding
the peer SDP discovery request.

For issue 2,
Add the description to note that if the SDP discovery type is
`Service Search` and `Service Search Attribute`, and UUID is UUID 128,
the passed UUID data of the discovery request parameter should be
represented as the little-endian byte-order sequence.

And swap the 128bit from little-endian to big-endian when packing the
SDP discovery packet.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-07-29 11:21:37 +01:00
Emil Gydesen
220571efcb Bluetooth: CCP: Check conn type before access by index
Ensure that the connection type of the provided bt_conn is
an LE connection.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-07-28 16:45:17 -04:00
Emil Gydesen
0347d92072 Bluetooth: BAP: SD: Add missing error checks for mutex locks
Add missing error checks for mutex locks after the mutexes
were changed to not use K_FOREVER which should not be done in
the BT RX thread.

A larger overhaul of how mutexes are using within the scan delegator
should be considered, as there are a lot of locks and unlocks when
handling the callbacks.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-07-28 16:44:58 -04:00
Cheng Chang
afcce53220 bluetooth: host: a2dp:error_code should be detailed in set_config_rsp
Error codes fall into two main categories:
case 1: NOT_SUPPORT_XXX. This means that the configuration of the
parameter is not supported locally.
case 2: INVALID_XXX. This means that the parameter is not configured or
duplicated in the set_config_req command.

Currently the protocol only supports SBC, so it is only checked for SBC
parameters.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-07-28 16:43:29 -04:00
Cheng Chang
f4153476cd bluetooth: host: a2dp: Fix null ops before calling configured callback
If stream->ops is NULL and not checked, it works fail.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-07-28 16:40:39 -04:00
Cheng Kai
cf61573ce9 Bluetooth: L2CAP: add br l2cap unregister interface
It needs to do l2cap unregister operation from app

Signed-off-by: Cheng Kai <chengkai@xiaomi.com>
2025-07-28 08:52:01 -04:00
Sean Madigan
3adae8bd9a bluetooth: host: Add support for extended feature set feature
This commit adds support for the extended feature set
feature. This includes:
- hci boilerplate
- kconfigs, including one for a max local feature page
- reading remote features is done by a command and callback
- this is not linked into the auto feature request on
connection as this procedure can take quite a few connection
events, and we do not want to delay the user
- added the commands to the bt shell

Signed-off-by: Sean Madigan <sean.madigan@nordicsemi.no>
2025-07-28 08:48:30 -04:00
Sean Madigan
cddea431eb bluetooth: host: hci_core: allow both orders of version and feature events
Previously, the version complete event had to come after
the remote feature complete event for the notify_remote_info
function to be called.

This becomes less practical when adding the read all remote
features complete event, as this can take some time. Meaning
the order of events is not predictable.

Signed-off-by: Sean Madigan <sean.madigan@nordicsemi.no>
2025-07-28 08:48:30 -04:00
Vinayak Kariappa Chettimada
5b1c209498 Bluetooth: Controller: Add missing atomic_get call
Add missing atomic_get call to access atomic value.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-28 08:45:59 -04:00
Vinayak Kariappa Chettimada
0a2934d1d2 Bluetooth: Controller: Fix assertion in ull_conn on HCI Reset
Fix assertion in ull_conn under race between connection
termination and processing of HCI Reset command.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-28 08:45:47 -04:00
Vinayak Kariappa Chettimada
e1541cc712 Bluetooth: Controller: Fix ULL Tx Ack index corruption under race
Fix ULL Tx Ack FIFO's first index being advanced beyond a
recorded ack_last value in a node_rx when under race.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-28 08:45:33 -04:00
Aleksandr Khromykh
c02ec1f645 bluetooth: mesh: remove persisted psa key if mesh does not own it
Commit adds destruction of the persisted in PSA ITS key if
mesh does not own it (zero bit in the bitmap of persisted keys).

This is not standard mesh behavior, but might happen
if something happens between removing key data in mesh and
in the crypto library (for example power off in bettwen).

Previously, mesh wasn't able to import key with gotten stuck
key id. The current fix reproduces more robust behavior.

Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
2025-07-25 08:17:24 -04:00
Omkar Kulkarni
602fd0d889 Bluetooth: Mesh: Blob Server considers friendship
Fix Max Chunk reporting during Block_Information_Get:
If friendship is established, then max possible chunk size for transfer
is reported according to friend's queue size.

ChunkSize = (FndQ sz * Bytes per seg (12)) - Opcode(1) - Chunk_Num (2)-
            8 byte MIC (max)
	  = (FndQ sz * 12) - 11

This allows all segments of Chunk_Transfer messages to fit in a friend
queue. If this is not done, friend queue keeps overflowing
systematically causing unstable PULL_MODE transfers.

Fix Chunk requests:
Adapt number of requested chunks according to current friend queue size.
If friend queue is too small, at least 1 chunk is requested.

Signed-off-by: Omkar Kulkarni <omkar.kulkarni@nordicsemi.no>
2025-07-25 08:14:26 -04:00
Vinayak Kariappa Chettimada
ede31d39f0 Bluetooth: Controller: Fix assertion using BT_CTLR_LOW_LAT_ULL_DONE
BT_CTLR_LOW_LAT_ULL_DONE is used to reduce CPU usage in LLL
context by delegating the done event dequeue to ULL_HIGH
context.

Building a HCI Controller with BT_CTLR_LOW_LAT_ULL_DONE had
assertion when used with BlueZ stack.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-21 13:04:44 -04:00
Vinayak Kariappa Chettimada
cebaad33b1 Bluetooth: Controller: Fix missing ticker force reset on being lazy
Fix missing ticker force reset when the ticker expiry was
skipped or rescheduled.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-21 13:04:36 -04:00
Vinayak Kariappa Chettimada
0ad4d86354 Bluetooth: Controller: Fix flash sync start from starving connection
Fix flash sync start from repeatedly forcing connection
event be skipped. Space new flash operation to be placed
in the past so that it does not force itself on to an
overlapping connection event.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-21 13:04:36 -04:00
Cheng Chang
c9651c6710 Bluetooth: host: a2dp: Fix stream recv callback not be checked
Now when role is sink and source sends data, stream recv callback is
not registered, apps works fail. so stream recv callback should be
checked.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-07-21 07:23:15 -04:00
Nirav Agrawal
b59d8d56bf bluetooth: bap_unicast_client: fix PTS BAP/UCL/SCC/BV-103-C failure
- In bap_unicast_client, it was assumed that ASE is binded with CIS
 handler during sending "received_stop_ready" to unicast_server.
- In case where unicast_client has not started the stream with
 "receiver_start_ready" att command to server, but wants to disable
 ASE which was Enabled previously (but not stream!) causes failure
 since there is no cis_create has happened and linked to ASE.
- In BAP_TS, "BAP/UCL/SCC/BV-103-C" has a same test conditions where
 client first enables the ASE, disable the ASE, and expecting
 "receiver_stop_ready" att command from client to server followed by
 server notification to enter its ASE in QoS_configured state.
- Removed this condition checks to send expected att command to
 server from Enabling ASE state to Disable ASE.

Signed-off-by: Nirav Agrawal <nirav.agrawal@nxp.com>
2025-07-20 12:24:43 -04:00
Vinayak Kariappa Chettimada
e3e410aeed Bluetooth: Controller: Fix LLCP event_counter value used during prepare
Fix LLCP to use event_counter value used during prepare to
compare instant to be the value as when in prepare and not
incorrectly use a stale value (when two radio events
overlap).

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-19 15:47:45 -04:00
Loic Domaigne
f314560b4a Bluetooth: Controller: Fix a potential NULL pointer dereference
Fix a potential NULL pointer dereference for skip_fields in the function
ull_adv_sync_copy_pdu_header. This issue been reported by Coverity.

Coverity CID: 392529

Signed-off-by: Loic Domaigne <tech@domaigne.com>
2025-07-19 13:50:57 -04:00
Håvard Reierstad
d989188f29 Bluetooth: Host: l2cap: Fix MPS/MTU confusion
The implementation used BT_L2CAP_ECRED_MIN_MTU to check the lower limits
of both MTU and MPS, instead of BT_L2CAP_ECRED_MIN_MPS for MPS. While
these are the same here, confusion may arise. This commit fixes the
confusion.

Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
2025-07-19 13:26:29 -04:00
Mark Wang
e71b5122f7 bluetooth: classic: add role switch API
add bt_conn_br_switch_role and bt_conn_br_set_role_switchable to control
the role switch, add DEFAULT_ROLE_SWITCHABLE Kconfig to control the default
role switch state.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-07-19 09:59:16 +02:00
Mark Wang
31fba83fb3 bluetooth: classic: add role changed callback
add `role_changed` to `struct bt_conn_cb` to notify the HCI_Role_Change
event to application.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-07-19 09:59:16 +02:00
Cheng Chang
5b204de53a Bluetooth: host: L2CAP: Fix configuration parameters not be checked
Now in other mode rather than basic mode, configuration parameters
include MTU, Flush Time and QoS have been checked.
But in basic mode, they also need to be checked, so the code about this
should not be controlled by macro CONFIG_BT_L2CAP_RET_FC.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-07-19 09:51:02 +02:00
Ravinder Singh
394c97a819 Bluetooth: LE: CONN: Added bt_conn_le_set_default_phy function.
Added bt_le_set_default_phy in hci. This handles
the HCI_LE_Set_Default_PHY HCI command.
Added call to bt_conn_le_set_default_phy in central_gatt_write and
peripheral_gatt_write samples.

Signed-off-by: Ravinder Singh <ravinder.singh2@infineon.com>
2025-07-19 09:46:34 +02:00
Make Shi
dcd9adec29 Bluetooth: AVRCP: Adjust positions of internal static functions
- Move the static function locations to beginning of the file to the
  file to avoid function declarations.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-07-19 09:40:19 +02:00
Make Shi
ba05d5c2b2 Bluetooth: Shell: AVRCP: support unit info request and response
Add avrcp_unit_info_req callback function in shell and a command to set
the unit info response.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-07-19 09:40:19 +02:00
Make Shi
c95d3167e2 Bluetooth: AVRCP: Implement unit message reception on the AVRCP target
- Add a new callback to support the situation when a unit info command is
  received, and add an API to respond to the unit info command.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-07-19 09:40:19 +02:00
Make Shi
a559fee00b Bluetooth: AVRCP: Refactored AVRCP API for CT/TG separation
- Only AVRCP connect and disconnect api for AVRCP common functions.
- Added _ct prefixes to all CT callback functions and feature APIs.
- Updated shell demo code for AVRCP API changes.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-07-19 09:40:19 +02:00
Szymon Janc
d699e8ccf0 Bluetooth: Host: Make error messages unique
Both bt_le_adv_stop() and bt_le_adv_resume() were logging same
error message. Add aditional context to it so that logs are
distinguishable.

Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
2025-07-11 08:25:53 -10:00
Lyle Zhu
e4569c434a Bluetooth: Classic: L2CAP: Fix retransmission timer restarting
When received the valid S frame, the retransmission timer should not
be restarted if unacknowledged I-frames have been sent but the
retransmission timer has not elapsed.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-07-09 09:43:12 -05:00
Vinayak Kariappa Chettimada
f6495d8b43 Bluetooth: Controller: Fix Tx Ack FIFO index corruption under race
Fix Tx Ack FIFO's first index being advanced beyond a
recorded ack_last value in a node_rx when under race
between ll_rx_get() being pre-empted while executing the
`tx_cmplt_get()` and a call to `ll_rx_put()` in an
interrupt service routine.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-09 09:42:58 -05:00
Loic Domaigne
a0a47a4b6d Bluetooth: ASCS: fix uninitialized pointer read
Fix uninitialized pointer read reported by Coverity.
Coverity CID: 529879

Signed-off-by: Loic Domaigne <tech@domaigne.com>
2025-07-08 13:44:37 -05:00
Lyle Zhu
d48e2bb4f4 Bluetooth: Classic: L2CAP: Fix issue that pending chan cannot be sent
When the returned buffer is a `NULL` of the pull function, it means
there is not any data needs to be sent. However maybe there is any
frame pending on other L2CAP channel needs to be sent over the same
ACL connection.

Re-trigger the TX processor. It will call the pull function again
and the pending buffer will be pulled from following L2CAP.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-07-08 13:41:39 -05:00
Cheng Chang
80602f32c6 bluetooth: AVDTP:in set config_rej_rsp,LOSC can't be added.
The current logic will result in rsp always being accept because LOSC
added is 0. and according to the spec, LOSC should not be added to the
Set Configuration Reject response.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-07-08 13:37:37 -05:00
Olivier Lesage
aa4e6ac0dd bluetooth: host: Handle failure to disable scan when updating own_addr
It wasn't taken into account that bt_le_scan_set_enable()
has a return value. It's not likely that the controller
rejects the command when BT_DEV_SCANNING is set, however.

Signed-off-by: Olivier Lesage <olivier.lesage@nordicsemi.no>
2025-07-08 13:37:26 -05:00
Olivier Lesage
ef7ede64cc bluetooth: host: Do not try to set NRPA when scanning with identity
Attempting this would fail (assuming the controller is implemented
correctly) because when using legacy commands it is not allowed to
change the device address while scanning.

It also did not make sense. If we have configured the scanner to use
the identity address as own_addr, because the advertiser and scanner
addresses are shared when using legacy commands, setting the adv NRPA
here would overwrite the identity address used by the scanner, which
I assume is not the intention.

Signed-off-by: Olivier Lesage <olivier.lesage@nordicsemi.no>
2025-07-08 13:37:26 -05:00
Olivier Lesage
11782dbbc0 bluetooth: host: rename bool scan_enabled -> scan_disabled
It represents whether scanning was disabled as part of this flow.

Signed-off-by: Olivier Lesage <olivier.lesage@nordicsemi.no>
2025-07-08 13:37:26 -05:00
Olivier Lesage
43223a1661 bluetooth: host: Fix uninitialized own_addr_type for legacy scan+adv
In 25c993e5b7 a new case was introduced
where own_addr_type is not set by bt_id_set_scan_own_addr properly.

This led to issues for users where increasing their zephyr version
led to failures to start scanning after advertising in the case where
CONFIG_BT_SCAN_WITH_IDENTITY=n and legacy advertising commands are used.

Signed-off-by: Olivier Lesage <olivier.lesage@nordicsemi.no>
2025-07-08 13:37:26 -05:00
Cheng Kai
ec0865cb4a Bluetooth: SDP: fix attr value len 32 invalid
fix sdp attr value len 32, which was not supported.

Signed-off-by: Cheng Kai <chengkai@xiaomi.com>
2025-07-07 10:13:47 -05:00
Make Shi
9104e941f9 Bluetooth: Classic: L2CAP: Set default value for BR timer timeout
When peer monitor and retransmission timeout are zero, set them to the
default values. This ensures that the monitor timeout is always a valid
value to avoid the L2CAP BR timer work queue hang.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-07-07 10:07:10 -05:00
Gaetan Perrot
1610aa0e9f bluetooth: host: a2dp: remove redundant null check
Remove duplicated check for 'ep->stream == NULL' to clean up conditionals
and avoid unnecessary repeated evaluations.

This cleans up the code and avoids unnecessary repeated condition
evaluation.

Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
2025-07-04 14:21:47 -10:00
Mark Wang
80c1e6929a bluetooth: smp: add todo comments for ctkd
need to consider corner cases of ctkd as the added code comments.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-07-04 13:10:21 -05:00
Mark Wang
81d938606d bluetooth: smp: CTKD issue when cross br and ble connections and security
The peer uses the RPA address.
A BR connection is created firstly, a subsequent BLE connection is
created secondly, the BR SMP CTKD occur thirdly (The BLE LTK is
derived from BR and the BR SMP distribute peer's IRK and identity address
here), but the BLE LTK is saved to key pool that is not
matched with the previous BLE connection because the derived LTK is saved
with identity address and BLE connection uses RPA. Fix it by: Resolve the
BLE connections' RPA with the derived IRK to find the previous BLE
connections and match the connections with derived LTK key.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-07-04 13:10:21 -05:00
Mike J. Chen
a392c33c60 bluetooth: fix bug when destroying tx queue buffers on disconnect
Channel tx_queue purging on disconnect was inconsistently handled
by the different channels: iso, l2cap, l2cap_br.

iso channels handled purging in the tx_data_pull hook.

l2cap and l2cap_br did the purging in channel delete functions
and did not expect tx_data_pull to be called for a disconnected
channel. Their data_pull functions could return a ptr to a
net_buf that was still on the tx_queue, which is problematic
when the conn tx_processor unrefs the returned buffer resulting
in multiple calls to the buf destroy function.

To make things consistent and correct, remove the code that tries
to purge tx_queues in the tx_processor and only do purging in
the channels themselves when they are deleted/disconnected.

Also refactor and clarify referencing of the net_buf returned
by tx_data_pull. It was confusing who had a reference and
when, which could vary depending on the length of the original
buffer. There are three cases: the buffer length is less
than the tx.mps, greater the mps but less than the mtu so
requiring segementation but not fragmentation, or greater than
both mps and mtu so requiring both segmentation and fragmentation.
The conn layer would increase the refcnt if the length was
greater than the mtu, but not have any awareness of whether
the net_buf was still on the tx_queue or not.

Now it is the tx_data_pull callbacks responsibitity to increment
the reference count if it is returning a pointer to a net_buf
that it is still keeping on the tx_queue for segmentation purposes.
The conn layer will now always transfer that reference into a
fragment view and not conditional it on the length relative to
the mtu, and always decrement the reference to the parent when
the fragment is destroyed.

So there is no risk of decrementing a reference to a net buf
that might still be on a tx_queue, which simplifies error
handling in particular.

Also add error handling paths for when asserts are not enabled.

Signed-off-by: Mike J. Chen <mjchen@google.com>
2025-07-03 11:59:02 -05:00
Vinayak Kariappa Chettimada
3eee7c5325 Bluetooth: Controller: Fix peripheral role assertion on conn update
Fix peripheral role assertion during connection update and
simultaneous flash operations.

prepare_cb: Actual EVENT_OVERHEAD_START_US = 6149

This happens due to instant latency at connection update
where the ticks_at_expire was in the past.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-03 11:56:59 -05:00
Vinayak Kariappa Chettimada
6935a4bf90 Bluetooth: Controller: nRF54Lx: Flash sync restrict to one iteration
Write operations are not constant time on nRF54Lx SoCs and
depend on the previous value present versus new value to be
written. Hence, perform no more than one iteration.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-07-03 11:56:59 -05:00
Jiawei Yang
89d54b6f48 Bluetooth: HFP: Fail to get Bluetooth Profile Descriptor List
In HFP PTS, cases run fail with the log 'Bluetooth Profile Descriptor
List UUID (0x111E) is missing'.

With this patch, the affected cases can pass correctly.

Signed-off-by: Jiawei Yang <jiawei.yang_1@nxp.com>
2025-07-03 11:54:40 -05:00
Mark Wang
b93dec9295 bluetooth: sdp: cast from 'const x *' to 'struct x *' drops const qualifier
SonarQube reports: cast from 'const struct _snode *' to 'struct _snode *'
drops const qualifier. Fix it by removing the const.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
(cherry picked from commit 7982ee0df13b7f9e54595f799e32f38c464b0f9e)
2025-07-02 03:52:02 -10:00
Mark Wang
3887980c29 bluetooth: sdp: fix the corner cases for the sdp discover
1. bt_sdp_discover may be called in two tasks at the same time:
(1) If the 2 calls are for 2 acl conns,
the same session may be new allocated to two acl conns.
(2) If the 2 calls are for the same acl conn, the same session should be
used.
Use the bt_conn_index to map acl conn with session to fix it.
2. fix that bt_sdp_discover may use one session that is disconnecting,
put req to reqs_next and process it after disconnected.
3. remove memset of session, reset each members individually.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
(cherry picked from commit dcbe5d7dc5d72ce0d2915cf2b291cc84a916a536)
2025-07-02 03:52:02 -10:00