bug: v/80281
Rootcause: Add a socket server and client to enable communication between the user and Bluetooth.
Signed-off-by: zhangyuan20 <zhangyuan20@xiaomi.com>
bug: v/67000
Add bt_cm_enable_enhanced_mode() and bt_cm_disable_enhanced_mode().
Support EM_BR_SNIFF_LOW_LATENCY and EM_BR_SNIFF_ULTRA_LOW_LATENCY.
They switch to lower sniff intervals for short-term low latency needs.
Disable API restores the default sniff parameters.
Note: idle timeout is not changed in current design. It may be extended in the future.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/86395
rootcause:
Previously, CCC descriptors (defined by `GATT_H_CCCD`) would automatically respond to *read requests* within the stack, while forwarding all *write operations* (including write requests and write commands) to the application. This allowed the app to detect when a characteristic's notify/indicate status changed, without needing to implement `on_read_cb`.
During the Android BTIF porting, CCC read requests started being passed up to the application. This introduced compatibility issues for existing services that used `GATT_H_CCCD` without registering an `on_read_cb`, resulting in unhandled read responses.
To preserve backward compatibility, a new `rsp_type` value — `ATTR_AUTO_RSP_CCC_READ` — is introduced for `GATT_H_CCCD`. It restores the original behavior:
* Automatically respond to CCC descriptor read requests inside the stack
* Still forward write requests and write commands to the application via `on_write_cb`
This allows legacy services to continue functioning without modification.
Apps that require full control over both read and write (e.g. Android BTIF layer) should use `GATT_H_CCCD_USER_RSP`.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/86395
Provides a hook for business logic to observe and track read requests
without changing existing ATT/CCCD behavior.
Application sees the request but its response data is ignored; stack
still uses internal values for protocol correctness.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/83024
Zephyr stack needs CCC handle to do CCCD.
Old stack only needs value handle.
So gattc_service.c adds a query helper.
It uses the full service DB to map value_handle to ccc_handle.
sal can use this function to find the correct CCC handle.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/84212
Rootcase: The lightweight sched_note_printf function in the NuttX backend does not
perform NULL safety checks for the %s format specifier. Passing a NULL pointer from
hsm_get_state_name leads to a NULL pointer dereference, triggering a data abort
exception on systems with memory protection (MMU/MPU) and causing a system crash.
Solution: This commit addresses the issue by modifying the HSM_SAFE_NAME macro to
use the ternary operator. It now explicitly returns the "None" string literal when
hsm_get_state_name returns NULL, guaranteeing that a valid, non-null C-string is always
passed to the logging function.
Signed-off-by: v-chenghuijin <v-chenghuijin@xiaomi.com>
bug: v/83955
Rootcause: euv_pipe_close records the address of the euv_pipe in the data field of each uv_pipe instance to be closed, which is used to release the euv_pipe instance after the close operation completes.
A scenario exists where calling euv_pipe_close followed by euv_pipe_read_stop or euv_pipe_read_start causes the client pipe's data field to be reset to NULL or the reader's address. This prevents the euv_pipe instance from being released after close completes.
This occurs because euv_pipe_read_stop does not check the uv_pipe's state before directly freeing cli_pipe.data, while euv_pipe_read_start only verifies whether cli_pipe is active. Both functions lack a check for the closing state.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/84700
Rootcause: Some configurations are not enabled in Android 15 and require the addition of macro controls in Android 15.
Signed-off-by: zhangyuan20 <zhangyuan20@xiaomi.com>
bug: v/83666
The callback macro `CALLBACK_REMOTE` currently used in gatts/gattc employs the member variable `callbacks`. For enhanced versatility, the callback member variables in adv and scan have been modified from `callback` to `callbacks`.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/83666
The callback macro `CALLBACK_REMOTE` currently used in gatts/gattc employs the member variable `callbacks`. For enhanced versatility, the callback member variables in adv and scan have been modified from `callback` to `callbacks`.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/83666
In the current bt_socket_profile file, all client-side callbacks use the generic macro interface
BREDR & common: CALLBACK_FOREACH
BLE: CALLBACK_REMOTE
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/59050
Rootcause:When reconnect to the headset during a call, the headset will obtain the call status through the cind command. Since Vela does not have modem, the status will be error. So, get cind from Android.
Signed-off-by: zhangyuan20 <zhangyuan20@xiaomi.com>
bug: v/82081
`bt_le_scan.h` is a globally exposed header file. Then, Zephyr's `#include <zephyr/bluetooth/bluetooth.h>` is declared as a private inclusion of Zephyr in CMake. However, the problem is that when third-party apps use my global `bt_le_scan.h`, the CMake system doesn't know where `zephyr/bluetooth/bluetooth.h` is and throws an error. One solution is for the third-party app to also declare a private inclusion of Zephyr in CMake, but this doesn't conform to design principles. The app only needs to be concerned with my framework layer. If the app also needs to include Zephyr's header files, then the framework layer is not properly configured. Therefore, `zephyr/bluetooth/bluetooth.h` must not be explicitly included in `bt_le_scan`.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/80811
Rootcause: In certain scenarios, users of `euv_pipe` must ensure all UV requests have completed execution before releasing resources. Consequently, it is necessary to notify users that `euv_pipe` has been fully released after its close operation is completed, thereby permitting subsequent operational procedures to proceed. Support for the close callback has therefore been added.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/80616
When passed to bt_socket_client_send_with_reply , it may contain undefined values, leading to unpredictable behavior. Initialize packet explicitly before using it.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/80617
When passed to bt_socket_client_send_with_reply , it may contain undefined values, leading to unpredictable behavior. Initialize packet explicitly before using it.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: V/80385
Rootcause: uv_loop_close() marks internal data structures as invalid (e.g., set to -1), but pending callbacks in the queue still reference these invalidated structures. When uv_run() is called later, it processes the queue using corrupted pointers, leading to segmentation faults and crashes. Solution: Introduce a new flag in uv_loop_close() to mark the loop as closed and check it in uv_run() and other loop-related functions to prevent execution of callbacks after closure, ensuring memory safety and avoiding invalid pointer access.
Signed-off-by: v-chenghuijin <v-chenghuijin@xiaomi.com>
bug: v/80592
Rootcause: The creation of the euv_pipe RPMSG Pipe is conditionally compiled based on the RPMSG configuration, whereas the Close behaviour lacks this restriction. Consequently, in certain scenarios, non-existent RPMSG pipes may be released, triggering an exception.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/70057
Rootcause: There exists a specific scenario where an application may fail to correctly accept connections. In L2CAP multi-role, multi-connection scenarios, if an instance with ID 0 is released due to disconnection, subsequent connection events will utilise ID 0 for identification. Should the server accept a connection and adopt ID 0 as the new listen channel ID, the application will be unable to distinguish whether a new listen channel ID requires processing. This results in the application being unable to accept further L2CAP connection requests from peer devices.
Therefore, `INVALID_L2CAP_LISTEN_ID` is introduced to distinguish this scenario. When the Client connects, the default `new_listen_id` uses `INVALID_L2CAP_LISTEN_ID`, indicating that the application need not add a new listen channel; otherwise, it must.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/70057
Rootcause: The PSM employed by L2CAP in LE and BR/EDR contexts are not identical concepts. The LE scenario utilises a simplified PSM, whereas the BR/EDR scenario employs the standard PSM. These differ fundamentally in their allocation methods and are not interoperable.
Consequently, the current implementation of listen and stop listen operations requires distinguishing between connection types. Add a new API `bt_l2cap_stop_listen_with_transport` to support stop listen on BR/EDR PSM. This modification will rectify the error where `bt_l2cap_stop_listen` fails to recognise connection types, whilst filtering operations specific to the BR/EDR type.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/79667
When deleting a GATTC instance, the Advanced API identifies clients based on their device address. If an application creates two GATTC instances with the same device address, and attempts to delete the second instance before the server has returned the asynchronous callback for the first deletion, both deletion operations will effectively target the same underlying GATTC instance due to the identical device address.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/79135
Rootcause: The current definition of `bt_oob_data_t` conflicts with the Android Bluetooth. In practice, this type definition is restricted to internal service usage and is not currently exposed externally.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/79115
Rootcause: Replace `calloc` with the C standard library function `malloc` to avoid compilation errors.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/79112
Rootcause: Within the Android build system, the RPMSG service is inaccessible. Consequently, the corresponding library path has been added to Android.bp, and the include header file for the source file utilising RPMSG has been updated.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/77564
The original bt_gattc_feature_get_service_cb_t callback only returned a
single gatt_service_t pointer. This is insufficient for feature-layer
use cases that require receiving all discovered services at once.
This patch updates the callback signature by adding:
- const gatt_service_t *services[] : array of discovered service pointers
- size_t count : number of services in the array
This allows the feature layer to receive a batch of services in a single
notification and avoids repeated per-service callbacks.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
bug: v/77564
Some processing logic in asynchronous callbacks is identical; extract this common code into a macro.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/77564
When deleting the Bluetooth asynchronous instance, the IPC cached messages are directly released, and their asynchronous callbacks will not be invoked. This could lead to memory leaks if resources are released within the callbacks.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/57319
Refactor L2CAP API to use handles instead of cookies for callback registration and management.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/77699
When the client clears resources, if tasks are still executing in the worker thread at that time, it will lead to a use-after-free issue.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/74823
The current execution time of `on_scan_result_cb` is excessively long. Replace `lib_dumpbuffer` with `BT_DUMPBUFFER` (disabled by default) to reduce callback execution time, thereby preventing watchdog timeouts.
Signed-off-by: liuxiang18 <liuxiang18@xiaomi.com>
bug: v/76708
Rootcause: `uv_close` does not guarantee the order in which close callbacks run.
There is a case where `euv_pipe_close2` and `euv_pipe_close` are called in sequence: if the `uv_close` initiated by `euv_pipe_close` completes first and frees the `euv_pipe_t` instance, `euv_pipe_close2` must access the invaliad address during its execution.
Therefore, add a status flag to ensure the `euv_pipe_t` instance is freed safely.
Signed-off-by: chejinxian1 <chejinxian1@xiaomi.com>
bug: v/66837
When deleting GATTC, if the application does not provide a callback, the Bluetooth async API cannot be invoked, leading to the inability to release gattc remote list and causing a memory leak.
Signed-off-by: jialu <jialu@xiaomi.com>
bug: v/62106
Add feature-layer GATT client (gatt_client_t) wrapping low-level GATTC callbacks.
Build a local services DB from discovery (service/characteristic/descriptor).
Provide stable UUID handle lookups and helpers (service/char/desc finders).
Implement async read/write for characteristics and descriptors, notify subscribe/unsubscribe, and MTU exchange.
Signed-off-by: zhongzhijie1 <zhongzhijie1@xiaomi.com>
zhangyuan20