Skip to content

Conversation

@expliyh
Copy link
Owner

@expliyh expliyh commented Oct 23, 2025

No description provided.

expliyh and others added 30 commits October 23, 2025 11:38
bug: v/74402

hdev->id_addr[id] may go out of bounds when hdev->id_count is larger than CONFIG_BT_ID_MAX.

Signed-off-by: liyuheng <liyuheng@xiaomi.com>
bug: v/74406

Rootcause: Missing boundary check caused out-of-bounds access when id exceeded CONFIG_BT_ID_MAX.

Signed-off-by: liyuheng <liyuheng@xiaomi.com>
Change running baudrate from `115200` from `3000000`.

Implement the function `bt_h4_vnd_setup` to update the HCI bandrate.

Add Kconfig `BT_H4_NXP_CTLR_WAIT_TIME_AFTER_BAUDRATE_UPDATE` to set
the waiting time after the controller bandrate HCI vendor specific
command sent. It is used to ensure the controller is ready to update
HCI bandrate.

Select `BT_HCI_SETUP` if `BT_H4_NXP_CTLR` is enabled.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Extend the function `bt_sdp_discover` to support service search
transaction and service attribute transaction.

Improve the `session->rec_buf`. If the net buffer cannot be allocated
from the channel, disconnect the SDP session.

Set the `MaximumAttributeByteCount` of the request
`SDP_SERVICE_SEARCH_ATTR_REQ` with the tail room of `session->rec_buf`.

Set the `MaximumAttributeByteCount` of the request `SDP_SERVICE_ATTR_REQ`
with the tail room of `session->rec_buf`.

Set the `MaximumServiceRecordCount` of the request
`SDP_SERVICE_SEARCH_REQ` according to the tail room of
`session->rec_buf`.

Handle the response code `SDP_SERVICE_SEARCH_RSP`, and
`SDP_SERVICE_ATTR_RSP`.

Handle the error `SDP_ERROR_RSP`. Start the next SDP discovery if the
error received.

If there no more request, disconnect the session.

If the request cannot be sent, start the next SDP discovery.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add set the parameter `type` to value
`BT_SDP_DISCOVER_SERVICE_SEARCH_ATTR`.

Update the SDP discovery callback function by adding a third parameter
`const struct bt_sdp_discover_params *params`. Make it align with
`bt_sdp_discover_func_t`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Currently, the minimum value of encryption key size is
`BT_HCI_ENCRYPTION_KEY_SIZE_MIN`.

Add a new Kconfig `BT_BR_MIN_ENC_KEY_SIZE`. It is used to set the
specific minimum encryption key size.
The default value is `BT_SMP_MIN_ENC_KEY_SIZE`. And it can be
configured if `BT_SMP_SC_ONLY` is not enabled.

Use `CONFIG_BT_BR_MIN_ENC_KEY_SIZE` as minimum encryption key size in
`br_sufficient_key_size`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Actively disconnect the connection with error code `BT_HCI_ERR_AUTH_FAIL`
when the notified link key type is not `BT_LK_AUTH_COMBINATION_P256` in
BR SC only mode.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The discovered SDP record of service attribute transaction response
cannot notified correctly. There is an error returned from function
`get_record_len()`.

For service attribute transaction response, only one attribute list
is returned. So the total record length is the buffer length. Return
buffer length directly from `get_record_len()` to fix the issue.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
In current implementation, the SDP response packet will be ignored if
the operation code is `BT_SDP_ERROR_RSP`. And the SDP transaction
request is done, but the application is not notified. And the pending
SDP transaction cannot be processed.

Notify application with empty buffer if the operation code is
`BT_SDP_ERROR_RSP`. And process the pending SDP transaction.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add Kconfig to configure the HF `CLI` and `VOLUME` features.

Add a macro `BT_HFP_HF_SDP_SUPPORTED_FEATURES` for SDP HF record.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a function at_get_string to get the string from the received AT
result code.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handle the unsolicited result code +CLIP.

Add a callback `clip` to notify the application if the configuration
`CONFIG_BT_HFP_HF_CLI` is enabled.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add tx pending queue to queue call AT commands.

Add a function bt_hfp_hf_cli to enable/disable CLI notification.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Only send AT command `AT+CMEE=1` if HFP_AG supports "Extended Error
result code".

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handle the unsolicited result code +VGS and +VGM if the configuration
`CONFIG_BT_HFP_HF_VOLUME` is enabled.

Add a callback `vgm` to notify the application speaker microphone
notification if the configuration `CONFIG_BT_HFP_HF_VOLUME` is enabled.

Add a callback `vgs` to notify the application speaker gain
notification if the configuration `CONFIG_BT_HFP_HF_VOLUME` is enabled.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add function bt_hfp_hf_vgm to configure Gain of Microphone.

Add function bt_hfp_hf_vgs to configure Gain of Speaker.

These functions are controlled by configuration
`CONFIG_BT_HFP_HF_VOLUME`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The AT command `AT+CLIP=1` or `AT+CLIP=0` cannot be parsed correctly.

Check `=` before get AT command value.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
It is a debug log message. It should be logged by LOG_DBG instead of
LOG_ERR.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
All set flags are cleared when call is terminated. But for case that
SLC is not disconnected, only call related flags should be cleared.

Just clear call related flags if the call is terminated.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handle the unsolicited result code +BSIR issued by the AG to indicate
to the HF that the in-band ring tone setting has been locally changed.

Add a callback `inband_ring` to notify the in-band ring tone setting.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Handle AT commands AT+VGM and AT+VGS.

Add function to notify microphone and speaker gain.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support separator "=".

If the separator is "=", only when result code is VGS" or "VGM", the
result code is valid.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add AT command sending structure to queue all AT commander needed to
be sent after the SLC established.

After the SLC established, send AT command line one by one.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Send AT command AT+VGM and AT+VGS after SLC established.

The `VGM` and `VGS` can be set by calling function `bt_hfp_hf_vgs` and
`bt_hfp_hf_vgs` in HF connection callback.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add function `bt_hfp_hf_get_operator` to read the currently network
operator of AG.

Add callback `operator` to notify the application of the response.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Expose a function to set the network operator and mode.

Response the AT+COPS? command with set mode and operator.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a function `bt_hfp_hf_accept` to accept the incoming call.

Add a flag BT_HFP_HF_FLAG_INCOMING to identify the incoming call.
Set the flag if the call_setup value is 1.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a dedicated SDP features definition.

Set feature "Three-way calling" by default both in SDP features
definition and AT command features definition. Because it is set
by default in Spec.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a configuration BT_HFP_AG_EXT_ERR for this feature.

If the feature is not set, response the ERROR to the peer if the AT
command AT+CMEE received.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a configuration BT_HFP_AG_CODEC_NEG to configure the feature.

Add a function bt_hfp_ag_audio_connect to setup the codec negotiation
procedure.

Improve AT+BAC and AT+BCC handle.

Add callback codec_negotiate to notify the application of codec
negotiation result.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a configuration `CONFIG_BT_HFP_AG_REJECT_CALL` for feature
`Ability to reject a call`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Check the ability of AG to reject a call. If the AG cannot reject the
call, return error `-ENOTSUP`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Define SDP records for HFP AG. Register HFP AG SDP service records in
AG initialization.

Register HFP AG RFCOMM server in AG initialization.

Register HFP AG SCO server in AG initialization.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Find HF object according to conn object index directly.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support HFP HF and AG in shell.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add a option `HFPHF` to find HFP HF SDP records from HFP AG side.

Add a SDP records discovery parameter `discov_hfphf` for this option.

Add a function `sdp_hfp_hf_user` to handle the discovery result.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Due to the interface of AG is updated, update AG sample accordingly.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Divide hfp_internal.h into two parts, HFP HF part hfp_hf_internal.h and
HFP common part hfp_internal.h.

Includes "hfp_internal.h" in file "hfp_ag_internal.h".
Includes "hfp_ag_internal.h" in file "hfp_ag.c".

Includes "hfp_internal.h" in file "hfp_hf_internal.h".
Includes "hfp_hf_internal.h" in file "hfp_hf.c".

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Due to the interface of HF is updated, update HF sample accordingly.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
There is an error reported in platform `native_sim` that the value of
`EOPNOTSUPP` is same as `ENOTSUP`.
It cause the building error `duplicate case value '-95'` reported.

Use `ENOEXEC` to replace `EOPNOTSUPP` to fix the building issue.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
The lock/unlock for AG/HF feature read access is unnecessary.
For AG feature, it only be changed when creating new AG object.
For HF feature, it only be changed when exchanging feature in SLC
establishment.

Remove the hfp_ag_lock/hfp_ag_unlock for AG/HF feature read access.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add `BOTH_SUPT_FEAT(ag, _hf_feature, _ag_feature)` to check if the
feature is supported by both side.
Add `HF_SUPT_FEAT(ag, _feature)` to check if the feature is supported
by HF.
Add `AG_SUPT_FEAT(ag, _feature)` to check if the feature is supported
by AG.

Use `BOTH_SUPT_FEAT/HF_SUPT_FEAT/AG_SUPT_FEAT` to optimize code that
checks whether a feature is supported.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Remove all unnecessary code lines `__fallthrough` from switch-case.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
If the AG works as Data Channel Acceptor, the ACL conn cannot be known
by the application of AG. Similar with HF, add ACL conn as the first
parameter to the `connected` callback of AG.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Change the arguments of HFP AG callback `sco_disconnected()` to SCO
conn and disconnection reason.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Change `ag` of print message to `AG`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
In current implementation, the active/hold call will be terminated
and notify the upper layer the status change of calls when the SLC
is broken. But the calls should not be terminated in this case.

Do not terminate the calls and only clear the status of all calls.
And disconnect the SCO connection if it is established.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
If the SLC is broken, all saved calls should be cleared.

Clear all calls in the callback `hf_disconnected()` and
`ag_disconnected()`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Check whether the conn index is out of bounds.

CID 520297
CID 520296

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Check whether the conn index is out of bounds.

CID 520290

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Support the case that there are some calls existed before SLC
established.

Add a callback to get the ongoing calls one by one from upper layer
when the response of the AT command `AT+CIND=?` from HF has been sent.

And set the Call, Call Setup, and Held Call indicators and report the
values int the response of AT command `AT+CIND?`. Then report all
ongoing calls in the `+CLCC` response.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
For read-only access to fields, `lock/unlock` is unnecessary.

Remove unnecessary `lock/unlock` protection for read-only access
fields of AG.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
If the any value of Call, Call Setup, and Held Call indicators is not
zero in the response of `AT+CIND?`, get all calls via `AT+CLCC`.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add shell command `ongoing_calls` to set the ongoing calls.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Change the callback `get_ongoing_call()` of the AG from synchronous to
asynchronous mode. It will help to avoid the Bluetooth host stack be
blocked in the context of callback `get_ongoing_call()`.

Add a function `bt_hfp_ag_ongoing_calls()` to set the ongoing calls and
reply the AT command `AT+CIND?` after the callback `get_ongoing_call()`
has been notified.

Add a delayable worker to avoid the AT command `AT+CIND?` never being
replied. After the time exceeds
@kconfig{CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT}, the response of
the AT command `AT+CIND?` will be replied.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
Add shell command `auto_select_codec` to select codec automatically
when codec negotiation callback is notified.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
There is a potential issue that the index of ACL may out of the
bounds of the array `bt_hfp_hf_pool` if the array size is not aligned
with the array size of `acl_conns`.

To avoid the potential issue, check if the ACL conn index is less than
the array size of `bt_hfp_hf_pool` before accessing the array
`bt_hfp_hf_pool` with ACL conn index.

Fixes #91172

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
@expliyh expliyh closed this Dec 10, 2025
@expliyh expliyh deleted the dev-hfp-cp-safe-1 branch December 10, 2025 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants