bug: v/80281
Rootcause: Add a socket server and client to enable communication between the user and Bluetooth.
Signed-off-by: zhangyuan20 <zhangyuan20@xiaomi.com>
bug: v/85464
Remove extraneous parameter in `BT_LOGE` call where format string has no corresponding placeholder for `packet->len_received`.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/85177
Add validation check to ensure received segment length does not exceed the negotiated MPS before processing. Abort channel if validation fails to maintain protocol integrity.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/85747
Fix connection manager disconnection logic: Only AVRCP Controller (CT) instances register explicit disconnect callbacks with the connection manager, while AVRCP Target (TG) connections are not proactively terminated during disable operations, leading to stale connection states and potential resource leaks.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/67000
Add bt_cm_enable_enhanced_mode() and bt_cm_disable_enhanced_mode().
Support EM_BR_SNIFF_LOW_LATENCY and EM_BR_SNIFF_ULTRA_LOW_LATENCY.
They switch to lower sniff intervals for short-term low latency needs.
Disable API restores the default sniff parameters.
Note: idle timeout is not changed in current design. It may be extended in the future.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/86062
Rootcause: not unregister rfcomm server when sdp register fails causing memory access after free
Signed-off-by: YuhengLi <liyuheng@xiaomi.com>
bug: v/83024
Restore the type==0 check so a non-NULL filter_uuid with type 0 is treated
as "discover all services," matching bt_gattc_discover_service behavior.
Add an inline comment to document the NULL-to-type=0 contract and avoid
invalid UUID discovery calls that can break subscription flow.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85531
When `conn.type = BT_CONN_TYPE_BR`, the original `get_le_addr_from_conn` function fails to locate the corresponding address, resulting in an address exception. The new `bt_sal_get_remote_address` function now incorporates logic to retrieve the LE address, making it a universal address retrieval interface for both BREDR and BLE.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/84474
When the SAL layer does not store the BREDR connection information, it returns info as NULL. At this point, attempting an erroneous address offset on info->conn will result in a null pointer return.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/84474
When the peer initiates a connection, the connection callback reporting logic lacks the `bt_conn_add` entry. This prevents the subsequent SAL layer from retrieving the corresponding `bt_conn_info_t` object for the address, leading to subsequent data transmission process failures.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/84474
1. Add a call to bt_conn_unref(conn)
2. Use the locally stored conn in the sal layer to avoid executing `bt_conn_unref`
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/84473
When the number of registered services exceeds the limit, records not captured by `gatt_sdp_records` will be returned. Subsequent attempts to locate pointer indices for release will fail.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/86395
rootcause:
Previously, CCC descriptors (defined by `GATT_H_CCCD`) would automatically respond to *read requests* within the stack, while forwarding all *write operations* (including write requests and write commands) to the application. This allowed the app to detect when a characteristic's notify/indicate status changed, without needing to implement `on_read_cb`.
During the Android BTIF porting, CCC read requests started being passed up to the application. This introduced compatibility issues for existing services that used `GATT_H_CCCD` without registering an `on_read_cb`, resulting in unhandled read responses.
To preserve backward compatibility, a new `rsp_type` value — `ATTR_AUTO_RSP_CCC_READ` — is introduced for `GATT_H_CCCD`. It restores the original behavior:
* Automatically respond to CCC descriptor read requests inside the stack
* Still forward write requests and write commands to the application via `on_write_cb`
This allows legacy services to continue functioning without modification.
Apps that require full control over both read and write (e.g. Android BTIF layer) should use `GATT_H_CCCD_USER_RSP`.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/86395
Provides a hook for business logic to observe and track read requests
without changing existing ATT/CCCD behavior.
Application sees the request but its response data is ignored; stack
still uses internal values for protocol correctness.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85608
rootcause: Adding SPP process handling to the bluetooth
service resolves the issue of non-flow control data
piling up in the protocol stack.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
bug: v/85645
rootcause: SPP SDP records used the wrong UUID byte order
and reused template data, so later registrations overwrote
previous RFCOMM channel/UUID and triggered false duplicates.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
bug: v/85645
rootcause:The SDP PROTO_DESC list was modified in place
without copying, so the RFCOMM channel element pointer
could become invalid or corrupt, leading to incorrect
SDP records.
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
bug: v/85714
The previous implementation did not handle zero-length AD items (len == 0)
and lacked sufficient boundary checks. As a result, padding bytes could be
misinterpreted as valid AD elements, leading to construction of invalid
bt_data entries with oversized data_len values.
This could further cause out-of-bounds memory access during advertising data
processing in the host stack.
This change adds proper handling for zero-length AD items, validates item
length and buffer boundaries, and enforces segment count limits to prevent
invalid bt_data construction.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85615
After adding LTK/IRK, the stack must trigger the settings commit path so the controller resolving list and related RPA advertise/scan behavior are updated. Previously there was no key-level commit hook for zblue settings, so the commit handler was not invoked for these updates.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/83024
Zephyr stack needs CCC handle to do CCCD.
Old stack only needs value handle.
So gattc_service.c adds a query helper.
It uses the full service DB to map value_handle to ccc_handle.
sal can use this function to find the correct CCC handle.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/83024
Some apps call bt_sal_gatt_client_discover_service_by_uuid() many times.
But current sal_gatt_client resets element index on every discover call.
So the discover result cannot be accumulated.
After discover finished, the service DB is incomplete.
Read / write by handle, especially CCCD, may fail.
This change copies service data by malloc and passes it to gattc_service.c.
gattc_service.c owns and frees this memory.
So the GATT service DB becomes complete and stable.
CCCD and other operations can work correctly.
Future plan:
Keep only one service DB, maintained by gattc_service.c.
sal_gatt_client_interface will use a dynamic list or array only during discovery.
After discovery, sal will not keep any service memory.
The service DB will be owned only by gattc_service.c.
This part is still TBD.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/83024
Some stacks (e.g. zblue) do not support parallel GATT discovery requests.
To improve compatibility, make if_gattc_discover_service transactional and
serialize discovery per connection in the common service layer.
When a discovery is in progress, queue additional discover requests and
start them one by one after receiving DISCOVER_CMPL. Clear pending discovers
on disconnect. Save filter_uuid in the queued gattc_op_t so each queued
request can be executed with its original parameters.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85615
See adapter_service.c. When adding/removing from the whitelist, the unknown type is treated as public, and the random type is passed directly.
The stack also needs a patch to convert random type addresses into identity addresses.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/83024
rootcause:
This will result in the upper layer not receiving the GATTC notify.
The `get_le_addr_from_conn` interface correctly retrieves the RPA address for the callback,
not the identity address.
The EALREADY return value indicates that ccc has already been subscribed to, so it is not an error.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85755
Add `BT_LOGI` log to print scan mode and bondable state in `adapter_set_scan_mode` function for better debugging and monitoring of adapter scan mode changes.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/85506
When either ZBLUE stack option is enabled, add a dependency on zblue for libbluetooth via nuttx_add_dependencies, so zblue’s include dirs are applied only to libbluetooth and not globally.
Signed-off-by: v-yichenxi <v-yichenxi@xiaomi.com>
bug: v/85292
spp: increase max connections from 2 to 9
- Modify BLUETOOTH_SPP_MAX_CONNECTIONS constant in kconfig
Signed-off-by: v-yuechen1 <v-yuechen1@xiaomi.com>
bug: v/85532
rootcause:
Because of the introduction of ATT over BR, `register_service` needs to complete both BLE service registration and SDP record registration. The original design uniformly cleaned up the intermediate `attr_db svc_attr_count = 0` upon function exit to allow for the registration of the next service.
However, when `gatt_sdp_create_record` fails to add a record, the function returns directly, failing to reach `svc_attr_count = 0`, causing anomalies in the subsequent GATT service registration process.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/84293
Rootcause: config->delay_report was unexpectedly set to 1 because a2dp_info->config was not initialized.
Signed-off-by: YuhengLi <liyuheng@xiaomi.com>
bug: v/85073
rootcause:
For example, an ACL connection might suddenly drop, due to issues such as controller problems or remote device problems.
Therefore, we might get an empty `conn`. We must perform a null check here to avoid operations like `conn->hdev` when calling the API.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/84936
The process sequence:
bt_sal_gatt_server_add_elements->add_service->add_characteristic->
add_descriptor, last register_service, so
if (svc_attr_count) {
register_service();
}
this part of the code cannot be called, remove it.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/84936
rootcause:
server_svcs[CONFIG_GATT_SERVER_MAX_SERVICES] is registered into
zblue gatt->ctx->db->slist via bt_gatt_service_register().
Each struct bt_gatt_service contains an slist node:
struct bt_gatt_service {
struct bt_gatt_attr *attrs;
size_t attr_count;
sys_snode_t node;
};
So the stack keeps a pointer to &server_svcs[i] in the slist.
When a service is removed, doing memmove on server_svcs will move the
struct bt_gatt_service object in memory.
But the stack still holds the old pointer (&server_svcs[i]) in the slist.
After memmove, that pointer refers to stale or wrong content.
This can break the service list and cause use-after-free / memory corruption.
Fix:
Do not compact server_svcs with memmove.
Keep the bt_gatt_service node address stable after registration.
Only keep server_db[CONFIG_GATT_SERVER_MAX_ATTRIBUTES] linear for attributes,
and allocate new services by finding free slots in server_svcs.
This allows server_svcs storage to be non-linear, while the stack slist still
manages a linear sequence of service attributes via the attrs pointer.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/85482
In the /service/ipc/socket/src/ directory, the scan-related source file is named bt_socket_scan.c, not bt_socket_le_scan.c.
Signed-off-by: jialu <jialu@xiaomi.com>
github-actions[bot]