Commit graph zephyr/subsys/bluetooth
Author SHA1 Message Date
Emil Gydesen
f4e14dfb24 Bluetooth: BAP: BA: Refactor discover to not do read
Refactor the bt_bap_broadcast_assistant_discover function
to not read receives at the end of discovery.
This makes the function more true to what it is supposed to
do, and significantly reduces the complexity of the
procedure and the read callback.

Users will be required to, if wanted, to read the
receive state themselves with the existing
bt_bap_broadcast_assistant_read_recv_state.

The start_offset had to be modified to avoid issues with
PA sync.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2026-01-06 10:29:22 +01:00
Emil Gydesen
f3b63a1bd6 Bluetooth: CCP: Server: Add support for get UCI
Add support for getting the UCI.
For now the UCI will be duplicated by the TBS
implementation, but will be optimizied in the future
so only one copy of the UCI exists.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2026-01-06 10:28:23 +01:00
Vinayak Kariappa Chettimada
eb109a274d Bluetooth: Controller: Fix missing chain pdu time reservation
Fix missing auxiliary chain pdu time reservation.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2026-01-02 16:01:26 +00:00
Vinayak Kariappa Chettimada
3baf507b97 Bluetooth: Controller: Tune aux offset calculation overhead assertion
Tune the aux offset calculation overhead assertion to use
EVENT_OVERHEAD_START_US; this is the correct maximum
overhead causing ISR latency for start of a radio event that
occurs thereafter.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2026-01-02 16:01:26 +00:00
Lyle Zhu
587e8b8df0 bluetooth: at: add explicit cast to char pointer in return statements
Add explicit casts from 'uint8_t *' to 'char *' in at_get_string()
and at_get_raw_string() return statements to resolve implicit cast
warnings. The data.start field is uint8_t *, but the functions
return char *.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2026-01-01 21:30:01 +01:00
zhenwei fang
66cbc55e6f Bluetooth: Classic: Fix net_buf leak
Release the buffer with net_buf_unref(rsp) once the reading default link
policy settings response has been parsed.

Signed-off-by: zhenwei fang <fangzhenwei@bytedance.com>
2025-12-30 08:39:00 +01:00
Mark Wang
9b4501977b bluetooth: a2dp: implement remaining a2dp SBC codec API functions
Add implementations for the following SBC codec parameter getter functions:
bt_a2dp_sbc_get_channel_mode(): returns the channel mode (mono, dual,
stereo, joint stereo); bt_a2dp_sbc_get_subband_num(): returns the number of
subbands (4 or 8); bt_a2dp_sbc_get_block_length(): returns the block length
(4, 8, 12, or 16); bt_a2dp_sbc_get_allocation_method(): returns the
allocation method (SNR or loudness).

These functions parse the SBC codec configuration parameters and return
the corresponding values, completing the API defined in a2dp_codec_sbc.h.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-12-22 14:45:48 +01:00
Ivan Iushkov
c3190d34aa Bluetooth: mesh: suppress clang warning in net.c
struct net_val is a packed struct containing
`struct bt_mesh_key dev_key` member which contains uint32_t
variable inside.
Compiling this code with llvm clang produces the following
warning:

`
error: field dev_key within 'struct net_val' is less aligned
than 'struct bt_mesh_key' and is usually due to 'struct net_val'
being packed, which can lead to unaligned accesses
[-Werror,-Wunaligned-access]
`

However, the `struct bt_mesh_key dev_key` is handled in accordance
to its actual alignment. I.e., it is copied using memcpy() which
prevents any alignment issues.

This commit resolves the following Zephyr issue:
https://github.com/zephyrproject-rtos/zephyr/issues/101144
by suppressing -Wunaligned-access warning
on the `struct net_val` declaration.

Signed-off-by: Ivan Iushkov <ivan.iushkov@nordicsemi.no>
2025-12-19 10:39:11 +01:00
Lyle Zhu
c848b05126 Bluetooth: Classic: Monitor setup_sco and accept_sco_req HCI commands
For some controllers, such as NXP IW612 Chipset, the PCM pins of
controller needs to be configured before the SCO connection is
established. And it requires to get the `air_coding_format` to
configure the PCM pins of controller.

So, it requires to known when the SCO connection will be established
and what the `air_coding_format` of the SCO connection.

Add the function `bt_sco_hci_cb_register()` to monitor the HCI
commands `setup_sco` and `accept_sco_req`.

Add the function `bt_sco_hci_cb_unregister()` to remove the monitor.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-19 10:23:35 +02:00
Lyle Zhu
9c710107da bluetooth: hfp_ag: Add Kconfig option for in-band ringtone
Add a new Kconfig option CONFIG_BT_HFP_AG_INBAND_RINGTONE to allow
enabling/disabling the in-band ringtone capability in HFP AG profile.

The in-band ringtone feature is now conditionally compiled based on
this configuration option. When disabled, the feature flags are set
to 0 and the bt_hfp_ag_inband_ringtone() API returns -ENOTSUP.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-18 05:35:53 +01:00
Lyle Zhu
9016f96e01 Bluetooth: Classic: HFP_HF: Refactor at parser
In current implementation, the additional buffer is required by AT to
store the parsing AT response data temporarily. To store the parsed
AT response data completely, the buffer size is as high as the MTU of
the RFCOMM connection. And the buffer is dedicated for each HFP HF
connection. That means the RAM usage depends on the MAX HFP HF
connection count. Actually, the RFCOMM receiving buffer is valid when
processing the received AT response. The changes aim to remove the
additional buffer and leverage the receiving buffer to process the AT
response.

And there is an issue found that the type of the additional buffer
length is `uint8_t`, while the configured RFCOMM receiving data length
is 65535. When the additional buffer length exceeds 255, the AT cannot
process the received data normally.

Replace manual buffer management with net_buf_simple in the AT command
parser. This change eliminates the need for manual position tracking
and buffer length management by leveraging Zephyr's existing buffer
utilities. And leverage RFCOMM receiving buffer instead of allocating
dedicated buffer.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-18 05:33:30 +01:00
Sylvio Alves
f8d2e00a0e includes: remove duplicated entries in zephyr-tree
Remove duplicated #include directives within the same
preprocessor scope across the Zephyr tree.

Duplicates inside different #ifdef branches are preserved
as they may be intentional.

Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2025-12-17 13:57:38 -05:00
Lyle Zhu
bf802d0237 Bluetooth: Classic: HFP_AG: Auto-select support highest quality codec
In current implementation, if the codec is not selected, the codec
CVSD will be used to as default value to start audio connection
procedure.

Optimize the codec selection to select the supported highest quality
codec as the default value.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-17 11:29:21 +01:00
Lyle Zhu
466dec3b3e Bluetooth: HFP AG: Add feature support check for voice recognition
Add feature support validation in `bt_hfp_ag_voice_recognition()` to
verify that both HF and AG support voice recognition feature before
attempting to activate/deactivate it.

This prevents attempting voice recognition operations when the feature
is not supported by either the Hands-Free device or the Audio Gateway,
returning -ENOTSUP in such cases.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-17 11:28:55 +01:00
Lyle Zhu
a9269f2012 Bluetooth: Classic: OBEX: Fix unchecked return value issue
Check the return value of the function `atomic_cas()`. If the new
value cannot be set for the OBEX server, return the error code
`BT_OBEX_RSP_CODE_INTER_ERROR`. If the new value cannot be set for
the OBEX client, return the error code `-EINVAL`.

Fix #100012
Fix #100018
Fix #100019
Fix #100021
Fix #100022
Fix #100023

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-17 10:53:04 +02:00
Mark Wang
ac395b2d85 bluetooth: avdtp: Check buf tailroom and len before using it
check buf->len before pulling data from buf, check buf tailroom before
adding data to buf.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-12-16 10:12:12 -06:00
Mark Wang
402edcf81c bluetooth: avdtp: Fix coverity by adding assertion for MTU size validation
Add assertion to ensure MTU is at least the size of the start header
before calculating the remaining length for fragmentation. This prevents
potential underflow when subtracting the header size from MTU.
Fix coverity #551657

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-12-16 10:12:12 -06:00
Make Shi
159b4a6d97 Bluetooth: AVRCP: Fix typo in callback name and opid/state
Correct typo and fix opid/state assignment.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-12-16 10:09:49 +01:00
Gang He
2594859a0e bluetooth: host: Add parameter check when creating periodic adv sync
In option of HCI_LE_Periodic_Advertising_Create_Sync, bit 2
depend on Periodic Advertising ADI Support feature.

Signed-off-by: Gang He <ganghe@sifli.com>
2025-12-10 15:44:43 +00:00
Gang He
23d873188b bluetooth: host: scan: Format source code
Run clang-format on scan.c

Signed-off-by: Gang He <ganghe@sifli.com>
2025-12-10 15:44:43 +00:00
Lyle Zhu
2571b7efa3 Bluetooth: Classic: HFP_HF: Fix invalid indicator index issue
A invalid indicator index will cause the underflow of the array
`ag_ind` if the indicator index is not returned by AG in the
response of AT command `AT+CIND=?`.

Replace hardcoded `-1` values with HFP_HF_INDICATOR_INVALID constant
for better code readability and maintainability. Add proper bounds
checking to validate indicator indices before accessing the `ag_ind`
array using the `ind_table` mapping.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-09 09:51:47 -05:00
Lyle Zhu
75ff93ae21 Bluetooth: Classic: HFP: Fix SCO conn cannot be released issue
There is an issue found that the sco conn cannot be released when the
SCO has been disconnected. The sco conn count is referred in the sco
connected callback due to the `sco_conn` is NULL while `sco_conn`
should not be NULL when the sco connected callback is triggered.

It is a race condition issue where the sco connected callback is
triggered before `sco_conn` is updated. The sco conn reference count
has been referred incorrectly, actually it should not be referred.

Replace direct pointer access to `sco_conn` with atomic operations to
prevent race conditions in concurrent SCO connection scenarios.

If the value of `sco_conn` is not NULL when trying to set the return
value of `bt_conn_create_sco()` to `sco_conn`, it means the race
condition occurs. In this situation, discount the sco conn reference
count to fix the issue.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-09 09:51:18 -05:00
Mark Wang
6e9eda8e1c bluetooth: a2dp: Replace manual loop with ARRAY_FOR_EACH macro
Replace the manual for loop with the ARRAY_FOR_EACH macro for better code
consistency.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-12-08 06:15:20 -05:00
Cheng Chang
abb707ca36 bluetooth: host: obex: Allow MOPL to exceed MTU for mobile compatibility
When MOPL  exceeds MTU, adjust it to match MTU instead of failing the
connection. This handles the common case where mainstream mobile
operating systems (iPhone and Android) negotiate
MOPL values greater than the RFCOMM or L2CAP MTU.

Signed-off-by: Cheng Chang <cheng.chang@nxp.com>
2025-12-05 10:54:21 +02:00
Emil Gydesen
ff4347571b Bluetooth: BAP: Bcast Source: Add missing use of variable
The broadcast_state variable was not used in
bt_bap_broadcast_source_update_metadata to verify the
state, but broadcast_source_get_state was instead called
twice.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-12-04 14:05:05 -05:00
Emil Gydesen
51946986e6 Bluetooth: BAP: Bcast Source: Refactor bt_bap_broadcast_source_reconfig
Refactor the bt_bap_broadcast_source_reconfig function to be less
complex by splitting the verification into multiple functions.

Additionally, it also fixes a rare, but potential, issue where
some subgroups were updated before a later subgroup would fail
to be updated. Added can_merge_codec_cfg_data to verify correctness
before we attempt to update any subgroups. This new check is also
applied to bt_bap_broadcast_source_create.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-12-04 14:05:05 -05:00
Emil Gydesen
b6e3f8ee5c Bluetooth: BAP: Broadcast source: Reduce complexicty of valid_param
Move the subgroup parameter validation to its own function to
reduce the size and complexity of valid_broadcast_source_param
to make Sonarcube happy.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-12-04 14:05:05 -05:00
Mark Wang
d776d00c42 bluetooth: sbc: move sbc to bluetooth
move sbc to bluetooth because only bluetooth uses it,
change CONFIG_LIBSBC_ENCODER and CONFIG_LIBSBC_DECODER as CONFIG_LIBSBC.

Signed-off-by: Mark Wang <yichang.wang@nxp.com>
2025-12-04 05:26:00 -05:00
Pavel Vasilyev
9227a7c131 bluetooth: buf: Fix callback protection for ISR context
Fix assertion failure when buf_rx_freed_notify() is called from ISR
by replacing k_sched_lock with atomic_ptr operations for callback
pointer access.

The scheduler lock is retained during callback execution in thread
context to maintain backward compatibility, but is skipped in ISR
context where it's not available.

Updated documentation to clarify the behavior difference between
thread and ISR contexts.

Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
2025-12-03 10:38:47 -05:00
Aleksandr Khromykh
00fdcf0582 bluetooth: mesh: lpn shouldn't relay messages received over friendship
Commit fixes the issue when lpn device relays
broad- and group cast messages received over
friendship queue. This is specification violation,
see Table 3.13: Network layer Network PDU retransmission
requirements. Also, it does not have sense since
sending messages have already happened and lpn
just consumes extra power to retransmit useless data.
In general, lpn device will be more power efficient after
this fix.

Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
2025-12-03 11:44:34 +01:00
Make Shi
8a5657427e Bluetooth: AVRCP: Mask invalid bit in absolute volume
PTS may send absolute volume values with bit 7 set, which exceed the
valid range. Instead of rejecting these values, mask the invalid bit
to ensure compatibility.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-12-03 11:41:55 +01:00
Make Shi
d58782fe1a Bluetooth: AVRCP: Return INVALID_COMMAND when PDU ID is invalid
Added a check in the vendor dependent handler to ensure the PDU ID
matches supported command handlers. If the PDU ID or command type
is invalid, respond with BT_AVRCP_STATUS_INVALID_COMMAND.

Signed-off-by: Make Shi <make.shi@nxp.com>
2025-12-03 11:41:55 +01:00
Radosław Koppel
9b35906861 Bluetooth: GATT: Simplify GAP write_name and apperance_write
Update write_name function to check the offset value against 0 as long
writes are not used here.
Simplify write_appearance function also to remove long writes support.
The appearance property is always 16 bit and is should not even support
long writes.

Signed-off-by: Radosław Koppel <r.koppel@k-el.com>
2025-12-02 18:40:50 -05:00
Vinayak Kariappa Chettimada
57e8cf516c Bluetooth: Controller: Fix BT_CTLR_LOW_LAT scan disable hang
When using BT_CTLR_LOW_LAT and LLL_PRIO equals ULL_LOW_PRIO,
add missing mayfly_enable() call for ULL_LOW execution
context, without this ticker_stop() does not get processed.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-12-02 15:22:52 -05:00
Pavel Vasilyev
6da559f565 bluetooth: host: Fix stale RPA usage after invalidation
Add !BT_ADV_RPA_VALID check to force RPA regeneration when re-enabling
an advertising set after RPA rotation occurred while disabled.

The BT_ADV_RANDOM_ADDR_UPDATED flag was added to prevent unnecessary
address regeneration (RPA/NRPA) between bt_le_ext_adv_param_set() and
bt_le_ext_adv_start() calls. However, this revealed an issue:

When RPA rotation (le_force_rpa_timeout) occurs while an advertiser is
disabled, BT_ADV_RPA_VALID is cleared but the RPA is not regenerated.
On subsequent bt_le_ext_adv_start() without a new param_set() call:
- BT_ADV_RANDOM_ADDR_UPDATED is already cleared (from previous start)
- Without BT_PER_ADV_ENABLED, no regeneration occurs
- Stale RPA is used, violating privacy requirements

Add !BT_ADV_RPA_VALID check for both connectable and non-connectable
advertisers to ensure fresh RPA generation when the previous RPA was
invalidated while the advertiser was disabled.

Fixes regression introduced in #98117.

Signed-off-by: Pavel Vasilyev <pavel.vasilyev@nordicsemi.no>
2025-12-02 11:40:39 +01:00
Jordan Yates
e401209af0 bluetooth: host: name AUTO_PHY choices
Add names to the automatic PHY update choices so the defaults can be
updated.

Signed-off-by: Jordan Yates <jordan@embeint.com>
2025-12-02 11:22:38 +01:00
Carles Cufi
a264b54f37 drivers: nrf: Clean up remnants of nrfx error codes
Starting with nrfx 4.0.0, the nrfx_err_t, NRFX_SUCCESS and NRFX_ERROR_*
have been deprecated. Most of them were removed here:

https://github.com/zephyrproject-rtos/zephyr/pull/99399

but a few were missed.

Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
2025-12-01 12:26:18 -05:00
Ivan Pankratov
a44583c8f4 dts: bindings: Rename gpio-radio-coex to radio-gpio-coex
Rename GPIO coex binding to use 'radio-' prefix for consistency with
other radio bindings (radio.yaml, radio-fem-two-ctrl-pins.yaml).

Updated beacon sample overlay and coex documentation.

Signed-off-by: Ivan Pankratov <ivan.pankratov@silabs.com>
2025-12-01 12:22:33 -05:00
Ivan Pankratov
6ccc58a8f6 dts: bindings: Rename generic-fem-two-ctrl-pins to radio-fem-two-ctrl-pins
Rename generic FEM binding to use 'radio-' prefix for consistency with
other radio bindings (radio.yaml, ble-radio.yaml).

Updated 3 board files, Nordic BLE controller HAL, documentation, and
test overlays. Added missing settle-time properties to pan1783a board.

Signed-off-by: Ivan Pankratov <ivan.pankratov@silabs.com>
2025-12-01 12:22:33 -05:00
Lyle Zhu
05dc860f11 Bluetooth: Classic: A2DP: Fix out of bounds issue
This is a negative detection. The conn index should be never out of
bounds of the array `connection`. Because the size of the array is
`CONFIG_BT_MAX_CONN`.

To improve the readability, add a `__ASSERT` checking to check if the
conn index is out of bounds.

CID 487769

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-01 08:31:26 +01:00
Lyle Zhu
e586213417 Bluetooth: Classic: SDP: Fix out of bounds issue
This is a negative detection. The conn index should be never out of
bounds of the array `bt_sdp_client_pool`. Because the size of the
array is `CONFIG_BT_MAX_CONN`.

To improve the readability, add a `__ASSERT` checking here. Check
whether the conn index is out of bounds.

Fix #99985

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-01 08:31:19 +01:00
Lyle Zhu
2b827d31fc Bluetooth: Classic: conn: Fix br conn cannot be found issue
There is a corner case that the connect complete event is notified
before the function `bt_hci_cmd_send_sync()` returns. Because the
created conn object is in the state of `BT_CONN_DISCONNECTED`, it
cannot be found in the connect complete event. As a result, the
connect can not established normally.

Fix the issue by setting the connect state and role before calling
the function `bt_hci_cmd_send_sync()`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-12-01 08:30:53 +01:00
Lyle Zhu
57b99f5846 Bluetooth: Classic: RFCOMM: Fix unchecked returned value issue
Check the return code of the function `bt_l2cap_br_server_register()`.

Fix #100016

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-11-28 17:26:21 +00:00
Vinayak Kariappa Chettimada
06cd4f5849 Bluetooth: Controller: Remove redundant Sync ISO must expire
Remove redundant Sync ISO must expire code that is not
planned to be implemented.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-11-28 17:25:50 +00:00
Vinayak Kariappa Chettimada
2ab41387a4 Bluetooth: Controller: nRF54Lx: Fix Radio Tx Power set
Fix incorrectly high Radio Tx Power being set as default.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-11-28 17:25:02 +00:00
Vinayak Kariappa Chettimada
6692264d22 Bluetooth: Controller: In-system profiling and CPU overhead assertions
Updated in-system profiling for CPU usage with on target
measurements and added assertion checks.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-11-28 17:24:09 +00:00
Vinayak Kariappa Chettimada
d82c1dcaec Bluetooth: Controller: In-system ticker_start and ticker_stop tests
Add in-system ticker_start and ticker_stop tests.

Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
2025-11-28 17:24:09 +00:00
Emil Gydesen
4bd0c33cdd Bluetooth: CSIP: Only allow rank changes with set size changes
The rank cannot be notified and the function allowed for
just updated to the rank. The CSIS spec does not mention
the usecase, nor support, for changing the rank of a device.
The spec only seems to allow for dynamic changes to the set
size (and only during that can the rank be set).

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
2025-11-27 16:01:36 +01:00
Nikodem Kastelik
ad1e5ac253 nordic: update and align to nrfx 4.0.1
New nrfx release contains major rework of nrfx drivers
instantiation making it easier to integrate with dts nodes.
Now, nrfx driver instances can no longer be `const`
because they contain driver runtime state.
Additionally, all nrfx drivers return `errno` error codes
instead of deprecated `nrfx_err_t`.

Signed-off-by: Nikodem Kastelik <nikodem.kastelik@nordicsemi.no>
2025-11-27 14:45:17 +01:00
Lyle Zhu
57b7899e3a Bluetooth: att: Fix NULL pointer access issue
If the connect type is not `LE`, the return value of function
`bt_conn_get_dst()` is a NULL pointer. In function `bt_addr_le_str()`,
 the NULL pointer will be accessed without any checking. It will cause
the issue `Segmentation fault` in the platform `native_sim`.

Fix the issue by checking the conn type at the beginning of the
function `eatt_auto_connect()`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
2025-11-27 11:34:39 +01:00