| 1452790f |
MediaAssistant: Add Device option to Push
This enables MediaAssistant.Push to work with local broadcast sources. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +7, -1 |
| c560149e |
shared/bap: Fix bt_bap_stream_io_get_qos for broadcast streams
This makes bt_bap_stream_io_get_qos work with broadcast streams. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +37, -1 |
| 603ffaf5 |
shared/bap: Fix not calling attach callback on bt_bap_attach_broadcast
bt_bap_attach_broadcast shall call the attach callback just as any
other instance of bt_bap_attach. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +2, -0 |
| 3c67d492 |
shared/bap: Add bt_bap_get_db
This adds bt_bap_get_db which can be used to access the gatt_db passed
to bt_bap_new. |
Luiz Augusto von Dentz |
2 months ago |
2 files, +13, -0 |
| a5ceeb41 |
bass: Add support for setting DEVICE_FLAG_PAST
This attempts to check if setting DEVICE_FLAG_PAST is possible based on
the MGMT settings. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +11, -1 |
| 4fe45c54 |
device: Add initial support for setting DEVICE_FLAG_PAST
This introduces device_set_past_support which can be used by drivers
to indicate that DEVICE_FLAG_PAST shall be changed. |
Luiz Augusto von Dentz |
2 months ago |
4 files, +77, -9 |
| 43aed48c |
bass: Only attach client if initiator
This makes calling to bt_bass_attach conditional to being the initiator
of the connection, otherwise both device may act as both roles which is
not recommended. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +5, -1 |
| 81a99593 |
bass: Fix handling of BT_BASS_MOD_SRC
If BT_BASS_MOD_SRC is received and the sync_state is set to
BT_BASS_SYNCHRONIZED_TO_PA it doesn't necessarily mean that the device
shall be removed, specially in case the assistant and broadcast source
are the same device.
In order to fix this behavior this attempts to free the setups that were
used for the BIS being modified, then if all setups are freed in the
process proceed to disconnect the service and then check if the
device is still considered connected after that, only if is not
connected then remove it. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +81, -56 |
| 9faf1244 |
monitor: Print data if LTV and data length don't match
If data length and LTV don't match this should be made visible so
issues like the data coming as all zeros as bellow can be detected:
> HCI Event: LE Meta Event (0x3e) plen 50
LE Periodic Advertising Report (0x0f)
Sync handle: 64
TX power: 127 dbm (0x7f)
RSSI: -55 dBm (0xc9)
CTE Type: No Constant Tone Extension (0xff)
Data status: Complete
Data length: 0x2a
Versus:
> HCI Event: LE Meta Event (0x3e) plen 50
LE Periodic Advertising Report (0x0f)
Sync handle: 64
TX power: 127 dbm (0x7f)
RSSI: -55 dBm (0xc9)
CTE Type: No Constant Tone Extension (0xff)
Data status: Complete
Data length: 0x2a
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 .......... |
Luiz Augusto von Dentz |
2 months ago |
1 file, +1, -1 |
| 0ff04a94 |
ioctl-tester: Fix handle value
Recent changes to emulator has changed the ACL handles to start at
handle 0x0001 in order to use dedicated ranges for different link
types. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +2, -2 |
| 39b541ed |
hostname: Remove unneeded include |
Bastien Nocera |
2 months ago |
1 file, +0, -1 |
| 50487180 |
hog-lib: Fix 32-bit integer truncation
Id paramter stored in getrep_id and setrep_id corresponds to a 32-bit
tag value passed to us from the kernel side of UHID. Specifying this
parameter as uint16_t breaks the synchronization after 65536 request
and renders the attached BLE device inoperable.
Fixes: cdddd7e69e06 ("android/hog: implement get_report functionality")
Fixes: 83ed02d06fca ("android/hog: Implement set_report functionality")
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
Andrey Smirnov |
2 months ago |
1 file, +2, -2 |
| c2d07264 |
shared/uhid.c: Fix 32-bit integer truncation
Id paramter given to bt_uhid_set_report_reply() and
bt_uhid_get_report_reply() corresponds to a 32-bit tag value passed to
us from the kernel side of UHID. Specifying this parameter as uint8_t
breaks the synchronization after 255 request and renders the attached
BLE device inoperable.
Fixes: 92ed637ab2bc ("shared/uhid: Add dedicated functions for each UHID opcode")
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
Andrey Smirnov |
2 months ago |
2 files, +4, -4 |
| bac077c9 |
transport: wait until BAP fd is writable/readable before resuming
Connection may still be pending when entering STREAMING.
Wait until the fd becomes readable/writable before continuing. |
Pauli Virtanen |
2 months ago |
1 file, +55, -14 |
| c584335d |
bap: tolerate inverted STREAMING and iso_connect_cb()
Ordering of STREAMING and iso_connect_cb() is unspecified, as
kernel/Glib do not preserve the order of these events.
STREAMING before iso_connect_cb() causes transport to fail Acquire()
since bt_bap_stream_io::connecting == true.
Fix by marking IO as connected even though the connection didn't yet
complete. The socket fd is valid, although not yet writable/readable.
Fixes: https://github.com/bluez/bluez/issues/1506 |
Pauli Virtanen |
2 months ago |
1 file, +21, -0 |
| 8d181e4e |
mgmt-tester: Fix handle value
Recent changes to emulator has changed the ACL handles to start at
handle 0x0001 in order to use dedicated ranges for different link
types. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +1, -1 |
| 025d2ef8 |
iso.rst: Add documentation for PAST/rebind
This documents how to use PAST procedures by doing bind on already
connected socket. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +20, -0 |
| 5c53260b |
MGMT: Add PAST Settings and Flags
This adds PAST Settings and Flags definitions and documentation. |
Luiz Augusto von Dentz |
2 months ago |
2 files, +6, -0 |
| a6974c55 |
monitor: Add support for PAST MGMT settings and flags
This adds parising support for PAST MGMT settings and device flags. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +3, -0 |
| d4811ecb |
iso-tester: Add tests for PAST procedures
This introduces the following tests that test PAST procedures both as
a sender, either for colocated broadcast source or a third peer, and as
receiver:
ISO Broadcaster PAST Info - Success
ISO Broadcaster PAST Info RPA - Success
ISO Broadcaster PAST Sender - Success
ISO Broadcaster PAST Receiver - Success |
Luiz Augusto von Dentz |
2 months ago |
1 file, +279, -13 |
| 8656f1aa |
emulator: Add initial support for PAST |
Luiz Augusto von Dentz |
2 months ago |
4 files, +358, -23 |
| 620c5b4a |
monitor: Use PAST to refer to Periodic Advertising Sync Transfer
This simplify the command and event names and their structs to just
use PAST in place of other terminology currently in use. |
Luiz Augusto von Dentz |
2 months ago |
2 files, +49, -29 |
| dacb93dd |
transport: Attempt to reuse object paths whenever possible
This attempts to reuse object paths whenever possible to make
scripting a little more predictable by not having the fd number
being increased regardless of the actual number of transports. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +26, -7 |
| 5d2616a7 |
client/player: Add 'auto' option to transport.select
This enables transport.select auto which enables to auto select the
broadcast transport configured with the local endpoints, the selecting
process will also dealt with linking the transport so it needs a timer
that waits all transports to be configure to then start linking and
finally select. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +85, -13 |
| fb183b28 |
client/player: Add 'auto' option to transport.acquire
This enables transport.acquire auto which enables to overwrite the
default behavior of prompting when endpoint is registering without
setting auto accept. |
Luiz Augusto von Dentz |
2 months ago |
1 file, +8, -4 |
| 2db2d359 |
doc: enable 6lowpan in tester.config and explain in test-runner.rst
Now that there is a 6lowpan-tester, enable requirements in tester
config, and explain what is needed in test-runner.rst |
Pauli Virtanen |
2 months ago |
2 files, +15, -0 |
| 8f0aa430 |
tools: add 6lowpan-tester
Add 6lowpan smoke testing. It only exercises the kernel 6lowpan L2CAP
connection handling, ipv6 testing is mostly out of scope for the tester.
Add tests:
Basic Framework - Success
Client Connect - Terminate
Client Connect - Disable
Client Connect - Disconnect
Client Recv Dgram - Success
Client Recv Raw - Success |
Pauli Virtanen |
2 months ago |
2 files, +685, -1 |
| 9e76fb9f |
bthost: Fix crash on l2cap_ecred_conn_rsp
This fixes the following crash:
Invalid read of size 2
at 0x4019907: l2cap_ecred_conn_rsp (bthost.c:2554)
by 0x4019907: l2cap_le_sig (bthost.c:2650)
by 0x4019907: process_l2cap (bthost.c:3137)
by 0x401BBA3: process_acl (bthost.c:3242)
by 0x401BBA3: bthost_receive_h4 (bthost.c:3402)
by 0x4008835: receive_bthost (bluetooth.c:2989)
by 0x493B862: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x49447A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x4944A4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x402645D: mainloop_run (mainloop-glib.c:65)
by 0x4026A34: mainloop_run_with_signal (mainloop-notify.c:196)
by 0x4025C55: tester_run (tester.c:1084)
by 0x4002A7B: main (l2cap-tester.c:2799)
Address 0x400bc02a4 is not stack'd, malloc'd or (recently) free'd |
Luiz Augusto von Dentz |
2 months ago |
1 file, +2, -2 |
| 3e17f888 |
bthost: handle L2CAP_FLOW_CONTROL_CREDIT_IND
Parse L2CAP_FLOW_CONTROL_CREDIT_IND and track credits, instead of
sending reject response. Nothing is done with the credit counts
currently. |
Pauli Virtanen |
2 months ago |
1 file, +32, -0 |
| 05f3aab7 |
bthost: handle L2CAP_DISCONN_RSP and remove l2cap_conns
Handle L2CAP disconnection response. On receiving disconnection request
or response, remove the associated connection.
Change disconnect handler signature to take also the handle and CID. |
Pauli Virtanen |
2 months ago |
3 files, +67, -3 |
| b3dd5998 |
shared/bap: fix crash when setting initial metadata of a stream
bt_bap_stream_metadata() when stream is IDLE causes IDLE->IDLE
transition and crashes due to UAF. This occurs if SelectProperties
provides a Metadata.
Fix by not updating state if stream is IDLE.
Log:
ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7ca9d83ec448 thread T0
#0 0x000000927dce in bt_bap_stream_metadata src/shared/bap.c:6525
#1 0x00000056ae75 in setup_config profiles/audio/bap.c:1790
#2 0x00000056b865 in bap_config_setup profiles/audio/bap.c:1831
0x7ca9d83ec448 is located 8 bytes inside of 160-byte region [0x7ca9d83ec440,0x7ca9d83ec4e0)
freed by thread T0 here:
#0 0x7fc9da2e5beb in free.part.0 (/lib64/libasan.so.8+0xe5beb)
#1 0x0000008e3481 in bap_stream_free src/shared/bap.c:1259
#2 0x0000008e4586 in bt_bap_stream_unref src/shared/bap.c:1342
#3 0x0000008e4b6e in bap_ucast_detach src/shared/bap.c:1366
#4 0x0000008e6b63 in bap_stream_state_changed src/shared/bap.c:1496
#5 0x0000008ec17d in bap_ucast_set_state src/shared/bap.c:1857
#6 0x0000008e75e4 in stream_set_state src/shared/bap.c:1543
#7 0x0000008f268c in stream_metadata src/shared/bap.c:2250
#8 0x0000008f2801 in bap_ucast_metadata src/shared/bap.c:2274
#9 0x000000927d3f in bt_bap_stream_metadata src/shared/bap.c:6523 |
Pauli Virtanen |
2 months ago |
1 file, +8, -2 |
| 49d69b77 |
shared/bap: check pac cc and metadata length before use
Don't read past buffer end if device provided bogus values for PAC
caps/metadata lengths.
Use iov pull properly, and also check metadata LTV validity. |
Pauli Virtanen |
2 months ago |
1 file, +20, -8 |
| d01da89d |
unit/test-hfp: Add incoming call interrupted test
This add the following test:
- /HFP/HF/CIT/BV-01-C
Verify that HF responds as expected when a normal incoming call
process is interrupted from the remote party. |
Frédéric Danis |
2 months ago |
1 file, +16, -1 |
| 78c723b4 |
unit/test-hfp: Add incoming call prior to connection test
This add the following test:
- /HFP/HF/ICA/BV-07-C
Verify that HF can connect to an AG that is receiving an in-coming
call. |
Frédéric Danis |
2 months ago |
1 file, +28, -1 |
| fc3aa8a9 |
unit/test-hfp: Add Answer Incoming Call with In-Band Ring tests for HF
This add the following tests:
- /HFP/HF/ICA/BV-01-C
Verify the incoming call is answered from HF, in-band ring tone.
- /HFP/HF/ICA/BV-02-C
Verify that the AG can change its in-band ring tone setting.
- /HFP/HF/ICA/BV-03-C
Verify that the HF alerts of an incoming call using the local ring
signal regardless of the presence of the in-band ring tone.
- /HFP/HF/ICA/BV-04-C-full
duplicate of /HFP/HF/ICA/BV-04-C test with full SLC setup.
/HFP/HF/ICA/BV-05-C (Verify that the HF alerts an incoming call using
a locally generated alert signal and can answer an incoming call in
the AG when the AG does not use an in-band ring tone as an alert
mechanism for the HF and the IUT allows an Audio Connection to be
present) is similar to /HFP/HF/TCA/BV-02-C/HFP/HF/ICA/BV-04-C-full for
the HF side. |
Frédéric Danis |
2 months ago |
1 file, +188, -2 |
| ff984192 |
shared/hfp: Add in-band ring tone setting support |
Frédéric Danis |
2 months ago |
2 files, +17, -0 |
| c285274d |
unit/test-hfp: Add dial tests for HF
This add the following tests:
- /HFP/HF/OCL/BV-01-C
Initiate a call placed to the last number
- /HFP/HF/OCL/BV-02-C
Handling ERROR response to a call placed to last number
- /HFP/HF/OCM/BV-01-C
Initiate a request to place a call with a memory location
- /HFP/HF/OCM/BV-02-C
Handling ERROR response to a call placed to an empty memory location
- /HFP/HF/OCN/BV-01-C
HF places a call with a phone number |
Frédéric Danis |
2 months ago |
1 file, +166, -0 |
| 217bd72c |
shared/hfp: Add dial support
If no number, NULL or empry string, is passed to hfp_hf_dial() this
will try to call the last dialed phone number using AT+BLDN.
If the phone number starts with '>' and is followed by a number nnn…,
up to 10 digits, it will call the phone number in memory entry nnn….
Else it will performed a voice call to the number provided. |
Frédéric Danis |
2 months ago |
2 files, +60, -2 |
| 4be24398 |
bass: Fix restricting the BIS indexes to 1 as assistant
MediaAssistant are created per BIS which creates a problem since
MediaAssistant.Push could only push one index at the time, so instead
of always using the index use 0xFFFFFF (no preference) and leave it up
to the delegator to decide. |
Luiz Augusto von Dentz |
3 months ago |
1 file, +4, -1 |
| 411e3e0e |
client/player: Fix prompting for bcode when one is already set
If bcode is non-zeroed it means it already has been set so there is no
reason to ask the user to overwrite it, also fixes the assumption that
only strings could be entered as bcode rather than a byte array. |
Luiz Augusto von Dentz |
3 months ago |
1 file, +51, -16 |
| 1067426b |
monitor: Fix instance where BN is printed as PTO
This fixes 2 instance where BN is printed as PTO. |
Luiz Augusto von Dentz |
3 months ago |
1 file, +2, -2 |
| 24c568a3 |
shared/hfp: Fix issues found by codacy
Move debug string after check of hfp pointer.
Add missing argument in debug trace.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
Frédéric Danis |
3 months ago |
1 file, +11, -11 |
| 273bf9ce |
gobex: Fix abort for SRM operation
The OBEX Abort operation currently triggers an OBEX session
which prevents further OBEX operations:
obexd[327475]: obexd/client/transfer.c:obc_transfer_register()
0x50e000001380 registered
/org/bluez/obex/client/session0/transfer0
obexd[327475]: obexd/client/session.c:obc_session_ref() 0x50c0000010c0:
ref=3
obexd[327475]: obexd/client/session.c:obc_session_ref() 0x50c0000010c0:
ref=4
obexd[327475]: obexd/client/session.c:session_process_transfer()
Transfer(0x50e000001380) started
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=3
obexd[327475]: Transfer(0x50e000001380) Error: Transfer cancelled by user
obexd[327475]: obexd/client/session.c:obc_session_ref() 0x50c0000010c0:
ref=4
obexd[327475]: obexd/client/transfer.c:obc_transfer_unregister()
0x50e000001380 unregistered
/org/bluez/obex/client/session0/transfer0
obexd[327475]: obexd/client/transfer.c:obc_transfer_free() 0x50e000001380
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=3
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=2
obexd[327475]: Unknown header offset for opcode 0x10
obexd[327475]: obexd/client/session.c:obc_session_shutdown()
0x50c0000010c0
obexd[327475]: obexd/client/session.c:obc_session_ref() 0x50c0000010c0:
ref=3
obexd[327475]: obexd/client/pbap.c:pbap_remove()
/org/bluez/obex/client/session0
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=2
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=1
obexd[327475]: obexd/client/session.c:session_unregistered()
Session(0x50c0000010c0) unregistered
/org/bluez/obex/client/session0
obexd[327475]: obexd/client/session.c:obc_session_unref() 0x50c0000010c0:
ref=0
As its highest bit is always set to 1, and so its value located after
G_OBEX_RSP_CONTINUE, the G_OBEX_OP_ABORT is part of the operations
constants.
This has been tested for PBAP and BIP-AVRCP with Android 15 and 16.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
Frédéric Danis |
3 months ago |
1 file, +1, -1 |
| f1fb4f95 |
core: Fix not resolving addresses
When using the likes of btd_adapter_get_device the address can sometimes
be the so called RPA which needs to be resolved in order to avoid
creating duplicated objects of the same device.
Note that normally the RPA are resolved in the kernel but there are
instances like BASS Add Source that may attempt to add a device direcly,
bypassing the GAP layer. |
Luiz Augusto von Dentz |
3 months ago |
3 files, +55, -7 |
| e3a16c28 |
device: Fix privacy
In order for devices to properly be programmed into the adapter
resolving list they need to set the flag DEVICE_FLAG_ADDRESS_RESOLUTION
but that is only done if device_address_is_private return true but
currently it doesn't check the rpa flag which indicates that the address
has been updated to its identity.
While at it this also update the rpa flag to privacy to better indicate
the feature rather than just the address type and then introduces
device_set_privacy/device_get_privacy and replaces the usage of
device_address_is_private with device_get_privacy whenever the features
itself needs to be checked, rather than the current address type in use.
Fixes: https://github.com/bluez/bluez/issues/1079 |
Luiz Augusto von Dentz |
3 months ago |
3 files, +16, -7 |
| 3e55476b |
client/player: Set QoS.Encryption if QoS.BCode is set
QoS.Encryption must be set in order for the daemon to interpret the
QoS.BCode as valid. |
Luiz Augusto von Dentz |
3 months ago |
1 file, +4, -0 |
| faca3165 |
shared/bass: Fix permissions not requiring encryption
Both Broadcast Audio Scan Control Point and Broadcast Receive State do
require encryption:
https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/24670-BASS-html5/out/en/index-en.html#UUID-dd95da9a-6ac0-3f45-7e34-13fa9e04d41c |
Luiz Augusto von Dentz |
3 months ago |
2 files, +3, -2 |
| 73dd85a1 |
doc: Fix typo in PreferredBearer property |
Bastien Nocera |
3 months ago |
1 file, +1, -1 |
| c53a4019 |
unit/test-hfp: Add Terminate Call tests for HF
This add the following tests:
- /HFP/HF/TCA/BV-01-C
Verify that the HF can terminate an ongoing call in the AG.
- /HFP/HF/TCA/BV-02-C
Verify that the AG, upon the corresponding action, terminates an
ongoing call. The AG then indicates this event to the HF.
- /HFP/HF/TCA/BV-04-C
Verify that the HF can release a call after dialing and prior to
call completion.
/HFP/HF/TCA/BV-03-C (Verify that after a call is terminated from the
remote party, the HF receives the proper indication from the AG) is
similar to /HFP/HF/TCA/BV-02-C for the HF side. |
Frédéric Danis |
3 months ago |
1 file, +85, -3 |
| 976d87ba |
unit/test-hfp: Add Reject Incoming Call tests for HF
This add the following tests:
- /HFP/HF/ICR/BV-01-C
Verify that the HF can reject an incoming call after being alerted.
- /HFP/HF/ICR/BV-02-C
Verify that the AG, upon the corresponding action, rejects an incoming
call and properly indicates this event to the HF. |
Frédéric Danis |
3 months ago |
1 file, +43, -1 |