The command buffer was incorrectly encoded due to the recent change to H:4
encoding. Instead of fixing the header offset, just use the newly
introduced bt_hci_cmd_alloc() API, since that takes care of correctly
encoding the command header when it gets sent.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Introduce a new bt_hci_cmd_alloc() API which only allocates a command
buffer and reserves sufficient headroom for H:4 and command headers, but
doesn't actually encode any of those headers into the buffer. Additionally,
modify bt_hci_cmd_send() and bt_hci_cmd_send_sync() so that they handle
such buffers and perform the header encoding correctly. To avoid
duplication, bt_hci_cmd_send_sync() now builds upon (i.e. calls internally)
the bt_hci_cmd_send() API.
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>
Fix incorrect aux offset value in the aux pointer in the
primary advertising channel PDUs when using single timer
tIFS switching feature in nRF54Lx.
End time was not captured when only Tx follow by Tx happens
in the primary advertising channels. End time needs to be
always captured when using single timer so that elapsed
packet timer value is correctly accumulated, for use to
setup subsequent radio transmission or reception inside the
same radio event.
Relates to commit 373dc0db71 ("Bluetooth: Controller:
Single timer use Extended Advertising nRF54L support").
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Do not clear timer clear subscription until the radio event
is done. This is required for single timer switching when
periodic chains are to be received by LLL scheduling. Each
PDU in the train requires the timer to be cleared when the
parent PDU has been received such that reception of
auxiliary PDU's radio_tmr_start_us() can use the relative
offset since last PDU reception.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Use defines for Transmit/Receive and Inter-frame spacing
related Radio End events. This will ease some spaghetti of
conditional compilations for single timer and direction
finding support.
Direction Finding is not yet supported when using single
timer software tIFS switching.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Fixup commit 031a17c271 ("Bluetooth: Controller: Align
DDPI usage with nRF54L power domains").
Align DDPI usage with nRF54L series power domains and
available DDPI configurations.
Use indices below 4 when needing to bridge with GPIO,
use indices below 8 when needing to bridge with MCU domain
like CCM and AAR; and use indices above 7 to bridge with
Peripheral domain.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
HAL_SW_SWITCH_TIMER_CLEAR_PPI is same as
HAL_SW_SWITCH_GROUP_TASK_ENABLE_PPI, hence the single PPI
suffice being disabled.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Bluetooth 6.1 has version number 0x0F and was released in May 2025.
This commit ensures this version number is properly decoded.
Going forward we may consider removing printing the version
number as a string because the feature set is more important
than the version number.
Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
The bt_le_ext_adv_info struct has been extended to also
contain the advertising and periodic advertising states.
Additionally, the function verifies the input to avoid
NULL pointer access, and the addr field is more
properly documented.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Adds a new abstract struct for unicast group that is
specific for CAP. The difference between this and the BAP
unicast group, is that the parameters are CAP streams and
thus ensuring that the streams in the group adhere to the
additional requirements that CAP has on top of BAP.
This also adds foreach functions for both CAP and BAP
to allow users to iterate on the streams in the
abstract groups.
Various samples, modules and tests have been updated
to use the CAP struct and API.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Core Specification 6.1 clarified exptected erro code in case peer
sending invalid Public Key. In case pairing is aborted during or
immediately after Public Key Exchange phase has completed (which is
the case here) expected reason code is set to "DHKey Check Failed".
This was affecting SM/CEN/KDU/BI-04-C and SM/PER/KDU/BI-04-C
qualification test cases.
Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
Fix up the bus fault by not violating the MAXPACKETSIZE
value range of NRF_CCM h/w peripheral.
Fix up relates to commit 920117922b ("Bluetooth:
Controller: nRF53x: Fix NRF_CCM MAXPACKETSIZE value").
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Fix incorrect elapsed events value when LLL event prepare_cb
was invoked but was aborted before anchor point sync. This
caused premature supervision timeouts under applications
configured with CONFIG_BT_CTLR_EVENT_OVERHEAD_RESERVE_MAX=n
and CONFIG_BT_CTLR_PERIPHERAL_RESERVE_MAX=n.
Fixes commit 247037bd3e ("Bluetooth: Controller: Fix
incorrect elapsed events value").
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
ticker_is_initialized() should only return true when the ticker is
running (triggered regularly). Users like nrf_flash_sync_is_required()
depend on this behavior.
When the bluetooth controller driver is closed, ll_deinit() calls
lll_deinit(), which stops the ticker from being triggered. Also
deinitialize the ticker to ensure that ticker_is_initialized() returns
false.
Signed-off-by: Marco Widmer <marco.widmer@bytesatwork.ch>
The target variable is a `uint8_t`. It is not reasonable to pass a
value with `uint16_t` in little-endian format.
Remove `sys_cpu_to_le16`, and pass the value directly.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When using Zero Latency IRQs do not invoke ISR_DIRECT_PM and
do not return to reschedule in the kernel.
Signed-off-by: Vinayak Kariappa Chettimada <vich@nordicsemi.no>
Updates the LE legacy pairing procedure as a result of errata ES-24491.
New part:
If the initiating device receives an LP_CONFIRM_R value that is equal to
the LP_CONFIRM_I value, the pairing process shall be aborted and fail
with "Confirm Value Failed" as reason.
Signed-off-by: Håvard Reierstad <haavard.reierstad@nordicsemi.no>
In the function `sdp_client_ss_search()` and
`sdp_client_ssa_search()`, the allocated buf is not released if the
required UUID is invalid.
Un-reference the allocated net buffer if the UUID is invalid.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Made a few complex functions simpler
Added missing default cases in switches
Fixes a bad cast that removed const
Moved loop iterators to inner loop
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
Fixes a few bad casts that ignored const
Add a few missing final else statement
Refactored aics_discover_func to be less complex by
moving some parts of it into a new function.
Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
The `session->param` should be updated to date whatever the function
`sdp_client_ssa_search()`, `sdp_client_sa_search()` or
`sdp_client_ss_search()` can be executed properly.
Update the `session->param` to the new `param` when executing the
function.
Fixes#91156
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
There is a potential issue that the index of ACL may out of the
bounds of the array `bt_hfp_hf_pool` if the array size is not aligned
with the array size of `acl_conns`.
To avoid the potential issue, check if the ACL conn index is less than
the array size of `bt_hfp_hf_pool` before accessing the array
`bt_hfp_hf_pool` with ACL conn index.
Fixes#91172
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
When there are br connections connected, find_key_in_use call
bt_conn_get_dst to get br connection's dst and bt_conn_get_dst return NULL,
then bt_keys_find_addr aseert because addr is NULL.
Signed-off-by: Mark Wang <yichang.wang@nxp.com>
- Remove memset on bt_l2cap_br_chan during SDP
disconnect to prevent overwriting resources
(e.g., rtx_work) still in use by L2CAP,
which handles channel cleanup itself.
- Delete unused partial_resp_queue to clean up code.
Signed-off-by: ZhongYao Luo <LuoZhongYao@gmail.com>
If the received data length is less than 2 in none basic mode, the
L2CAP channel connection will be dropped.
Only check the received data length if the `SAR` is
`BT_L2CAP_CONTROL_SAR_START`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support zero-length SDU sending if the L2CAP channel connection is not
in basic mode.
Flag the zero-length SDU buffer and clear it if it has been processed.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Commit changes BT_MESH_DFU_FWID_MAXLEN option to be
compliant with BLE Mesh specification.
Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no>
If the controller resolving list is cleared by HCI_LE_Clear_Resolving_List,
don't need to enable the controller address resolution.
Signed-off-by: Mark Wang <yichang.wang@nxp.com>
Handle the ECHO request/response of classic L2CAP signaling packets.
Add the functions `bt_l2cap_br_echo_cb_register()` and
`bt_l2cap_br_echo_cb_unregister()` to register/unregister the ECHO
callbacks to monitor the ECHO REQ and RSP.
Add the function `bt_l2cap_br_echo_req()` to send the ECHO REQ through
classic L2CAP signaling channel.
Add the function `bt_l2cap_br_echo_rsp()` to reply the ECHO REQ
through the classic L2CAP signaling channel.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Disconnect the L2CAP channel connection if the proposed MTU is less
than min MTU or more than local supported MTU.
The main scenes are as follows.
If the proposed MTU is less than MIN MTU.
1. The channel connection of client and server is established,
2. Client/server sends channel config REQ (MTU=50),
3. Peer replies channel config RQP (Unaccepted/success with MTU=30),
4. The client/server will repeat step 3~4 if the RSP is unacceptable.
With the change applied, the local will disconnect the L2CAP channel
connection in step 3.
If the proposed MTU is more than local supported MTU.
1. The channel connection of client and server is established,
2. Client/server sends channel config REQ (MTU=50),
3. Peer replies channel config RQP (Unaccepted/success with MTU=80),
4. The client/server will repeat step 3~4 if the RSP is unacceptable.
With the change applied, the local will disconnect the L2CAP channel
connection in step 3.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Change the callback `get_ongoing_call()` of the AG from synchronous to
asynchronous mode. It will help to avoid the Bluetooth host stack be
blocked in the context of callback `get_ongoing_call()`.
Add a function `bt_hfp_ag_ongoing_calls()` to set the ongoing calls and
reply the AT command `AT+CIND?` after the callback `get_ongoing_call()`
has been notified.
Add a delayable worker to avoid the AT command `AT+CIND?` never being
replied. After the time exceeds
@kconfig{CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT}, the response of
the AT command `AT+CIND?` will be replied.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
If the any value of Call, Call Setup, and Held Call indicators is not
zero in the response of `AT+CIND?`, get all calls via `AT+CLCC`.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
For read-only access to fields, `lock/unlock` is unnecessary.
Remove unnecessary `lock/unlock` protection for read-only access
fields of AG.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support the case that there are some calls existed before SLC
established.
Add a callback to get the ongoing calls one by one from upper layer
when the response of the AT command `AT+CIND=?` from HF has been sent.
And set the Call, Call Setup, and Held Call indicators and report the
values int the response of AT command `AT+CIND?`. Then report all
ongoing calls in the `+CLCC` response.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The LTK cannot be derived by LK when LK is not weaker than the old LTK.
Improve the function `smp_br_pairing_allowed()` to avoid the LTK be
overwrote when old LTK has MITM protection but new LK has not MITM
protection.
Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
LE and BR connection have already been established, after that, LE
disconnection occurs, BR connection will not be selected as the next
default connection.
Fix this issue by searching for both BR and LE after disconnection
occurs.
Signed-off-by: Can Wang <can.wang@nxp.com>
