| 97c4d64f |
monitor: Track connections for analyze function |
Marcel Holtmann |
4 years ago |
1 file, +154, -2 |
| 5ddd8cd5 |
monitor: Remove unneeded fprintf for new devices |
Marcel Holtmann |
4 years ago |
1 file, +0, -2 |
| f9b8fac2 |
monitor: Count number of control messages |
Marcel Holtmann |
4 years ago |
1 file, +20, -0 |
| 30a4fdcb |
monitor: Add ISO packets to analyze option |
Marcel Holtmann |
4 years ago |
1 file, +22, -0 |
| f7223673 |
monitor: Remove unneeded fprintf for unknown opcodes |
Marcel Holtmann |
4 years ago |
1 file, +0, -1 |
| 6bbb22a0 |
gatt-db: remove redundant check in foreach range
svc_start < foreach_data->end has already been checked in a few lines
before.
Reviewed-by: Archie Pusaka <apusaka@chromium.org> |
Yun-Hao Chung |
4 years ago |
1 file, +2, -2 |
| 9cd5c344 |
main.conf: Revert default for Privacy and Experimental
Privacy shall be off by default until kernel is stable to support it,
also Experimental shall only be enabled for testing purpose. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +2, -2 |
| 8e53124d |
monitor: Print EIR of Extended Advertisement Report
It's useful to be able to see Extended Adv's EIR flags just like the
legacy Adv. |
Sonny Sasaka |
4 years ago |
1 file, +1, -0 |
| ba8a23d4 |
gatt: Add support for Central Address Resolution characteristic
This adds Central Address Resolution characteristic so peripherals can
use directed advertising using RPA as initiator address. |
Luiz Augusto von Dentz |
4 years ago |
2 files, +26, -8 |
| b497b594 |
adapter: Fix storing discoverable setting
discoverable setting shall only be store when changed via Discoverable
property and not when discovery client set it as that be considered
temporary just for the lifetime of the discovery. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +22, -13 |
| bb27e5e1 |
obexd: phonebook: Set default apparams for PTS clients
Some PTS clients do not send all the mandatory apparams
when retrieving the phonebook. Clients such as car multimedia systems
cannot be fixed, therefore working around this issue by inserting
default apparams which makes these clients work as well. |
Hannu Mallat |
4 years ago |
1 file, +15, -0 |
| edb86e5e |
configure.ac: add libebook dependency
Require libebook when phonebook-ebook plugin is built. |
Dylan Van Assche |
4 years ago |
3 files, +11, -2 |
| b1c73f4d |
configure.ac: specify phonebook plugin at build time
Various phonebook plugins are available, by default
phonebook-dummy is always built. Allow to specify
which plugin to use at build time. |
Juho Hamalainen |
4 years ago |
2 files, +9, -1 |
| bdeaad3f |
obexd: phonebook-ebook: modernize
Modernize PBAP phonebook-ebook plugin for newer libebook version
of the Evolution Data Server.
The ebook plugin was introduced during GSoC 2011 [1] and allows
BlueZ to share contacts stored in the Evolution Data Server to
connected clients such as car multimedia systems.
With the rise of Mobile Linux thanks to the PinePhone and Librem 5,
this plugin was modernized to compile with newer libebook versions
because the API was changed [2].
[1] http://www.bluez.org/gsoc-eds-backend-of-phonebook-access-profilepbap/
[2] https://wiki.gnome.org/Apps/Evolution/ESourceMigrationGuide |
Dylan Van Assche |
4 years ago |
1 file, +320, -348 |
| e0ea1c9c |
tools: btmgmt: support quality experiment feature command
This patch adds the "exp-quality" command to btmgmt to enable/disable
the Bluetooth quality report. |
Joseph Hwang |
4 years ago |
1 file, +48, -0 |
| 7be40ec8 |
adapter: read quality report feature
This patch adds a new UUID for the quality report experimental
feature. When reading the experimental features, it checks if
the new feature is supported by the controller and stores the
value in the quality_report_supported flag of the adapter.
The quality_report_supported flag could be used by the bluetoothd
to determine if the quality report feature can be enabled.
Reviewed-by: Miao-chen Chou <mcchou@chromium.org> |
Joseph Hwang |
4 years ago |
2 files, +18, -0 |
| de6c0c77 |
monitor: add new Intel extended telemetry events
This patch adds new Intel extended telemetry events for both ACL and
SCO/eSCO audio link quality reports.
For SCO/eSCO audio link quality report, it shows something like
> HCI Event: Vendor (0xff) plen 190 #120 [hci0] 2021-05-31 20:27:50.257
Vendor Prefix (0x8780)
Intel Extended Telemetry (0x87)
Extended Telemetry (0x80): SubOpcode (0x03)
Extended event type (0x01): Audio Link Quality Report Type(0x05)
SCO/eSCO connection handle (0x6a): 0x0101
Packets from host (0x6b): 399
Tx packets (0x6c): 403
Rx payload lost (0x6d): 3
Tx payload lost (0x6e): 0
Rx No SYNC errors (0x6f): 3 2 3 3 0
Rx HEC errors (0x70): 0 0 0 0 0
Rx CRC errors (0x71): 2 0 0 0 0
Rx NAK errors (0x72): 6 0 0 0 0
Failed Tx due to Wifi coex (0x73): 6 0 0 0 0
Failed Rx due to Wifi coex (0x74): 0 0 0 0 0
Late samples inserted based on CDC (0x75): 0
Samples dropped (0x76): 0
Mute samples sent at initial connection (0x77): 0
PLC injection data (0x78): 0
For ACL audio link quality report, it shows something like
> HCI Event: Vendor (0xff) plen 142 #120 [hci0] 2021-05-31 20:27:50.261
Vendor Prefix (0x8780)
Intel Extended Telemetry (0x87)
Extended Telemetry (0x80): SubOpcode (0x03)
Extended event type (0x01): Audio Link Quality Report Type(0x05)
ACL connection handle (0x4a): 0x0100
Rx HEC errors (0x4b): 0
Rx CRC errors (0x4c): 0
Packets from host (0x4d): 100
Tx packets (0x4e): 101
Tx packets 0 retries (0x4f): 89
Tx packets 1 retries (0x50): 11
Tx packets 2 retries (0x51): 1
Tx packets 3 retries (0x52): 0
Tx packets 4 retries and more (0x53): 0
Tx DH1 packets (0x54): 0
Tx DH3 packets (0x55): 0
Tx DH5 packets (0x56): 0
Tx 2DH1 packets (0x57): 0
Tx 2DH3 packets (0x58): 0
Tx 2DH5 packets (0x59): 0
Tx 3DH1 packets (0x5a): 6
Tx 3DH3 packets (0x5b): 0
Tx 3DH5 packets (0x5c): 94
Rx packets (0x5d): 272
ACL link throughput (KBps) (0x5e): 343815
ACL max packet latency (ms) (0x5f): 20625
ACL avg packet latency (ms) (0x60): 12
Reviewed-by: Miao-chen Chou <mcchou@chromium.org> |
Joseph Hwang |
4 years ago |
3 files, +503, -9 |
| cb53d86b |
core: fix a possible crash when removing devices
In probe_service, if the service already exists in device->services, it
returns the service. This might cause dev_probe and device_probe_profile
to add a duplicate service into device->services. When removing the
device, a double-free error might occur.
This patch changes the logic of probe_service so that the same service
will not be added to a device. |
Yun-Hao Chung |
4 years ago |
1 file, +4, -1 |
| 0f849abb |
btdev: Fix not checking conditions for LE Set Random Address
The spec says LE Set Random Address cannot be used when scan is enabled
or with legacy advertising:
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2480
'If the Host issues this command when any of advertising (created
using legacy advertising commands), scanning, or initiating are
enabled, the Controller shall return the error code Command
Disallowed (0x0C).' |
Luiz Augusto von Dentz |
4 years ago |
1 file, +13, -0 |
| 0356d2a4 |
btdev: Add proper checks for own_addr_type for LE scan/adv
own_addr_type 0x01 and 0x03 shall check that a random address has
properly been set:
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2496:
'If LE_Scan_Enable is set to 0x01, the scanning parameters'
Own_Address_Type parameter is set to 0x01 or 0x03, and the random
ddress for the device has not been initialized, the Controller shall
return the error code Invalid HCI Command Parameters (0x12).'
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2614:
'If Enable is set to 0x01, the scanning parameters' Own_Address_Type
parameter is set to 0x01 or 0x03, and the random address for the
device has not been initialized, the Controller shall return the
error code Invalid HCI Command Parameters (0x12).' |
Luiz Augusto von Dentz |
4 years ago |
2 files, +81, -24 |
| daea5695 |
tool/mgmt-tester: Add fail_tolerant exception
Race conditions with the cmd-sync changes can cause fail status codes to
be different than originally expected. New test parameter fail_tolerant
allows a trivial fail-code mismatches to "Pass" while also warning that
the status wasn't exactly as expected. |
Brian Gix |
4 years ago |
1 file, +9, -2 |
| 41bf62e0 |
tool/mgmt-tester: Add test cases for Read Clock Information API
This patch adds test cases for Read Clock Information management API. |
Brian Gix |
4 years ago |
1 file, +70, -1 |
| 14c6a732 |
emulator/btdev: Add support HCI_READ_CLOCK command
This patch adds support HCI_READ_CLOCK command in btdev. |
Tedd Ho-Jeong An |
4 years ago |
1 file, +18, -0 |
| 16395e11 |
a2dp: Fix crash in channel_free while waiting cmd resp
When channel_free is called and we are waiting for a command response
from the peer, bluez NULL the setup->session but would not free its
setup_cb. Since setup_cb holds a ref of setup, the setup wouldn't be
freed and if service_removed is called after channel_free, a2dp_cancel
tries to abort the ongoing avdtp commands, which accesses the
setup->session and triggers a crash.
This change finalizes all avdtp commands before assigning setup->session
to NULL in channel_free.
Crash stack trace:
0x000059f01943e688 (bluetoothd -avdtp.c:3690)
avdtp_abort
0x000059f01943928a (bluetoothd -a2dp.c:3069)
a2dp_cancel
0x000059f0194377fa (bluetoothd -sink.c:324)
sink_unregister
0x000059f01948715a (bluetoothd -service.c:177)
service_remove
0x000059f01948d77c (bluetoothd -device.c:5346)
device_remove
0x000059f019476d14 (bluetoothd -adapter.c:7202)
adapter_remove
0x000059f019476c3e (bluetoothd -adapter.c:10827)
adapter_cleanup
0x000059f01949d8d7 (bluetoothd -main.c:1114) main
0x0000787b36185d74 (libc.so.6 -libc-start.c:308)
__libc_start_main
0x000059f019433e39 (bluetoothd + 0x00026e39) _start
0x00007fff2d2c0127
Reviewed-by: Archie Pusaka <apusaka@chromium.org> |
Yun-Hao Chung |
4 years ago |
1 file, +39, -1 |
| 8f30f083 |
btdev: Add proper checks for own_addr_type for extended advertising
own_addr_type 0x01 and 0x03 shall check that a random address has
properly been set and in case of 0x03 the resolving list actually
contains the irk of the identity address:
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2596
'If the advertising set's Own_Address_Type parameter is set to 0x01
and the random address for the advertising set has not been
initialized, the Controller shall return the error code Invalid HCI
Command Parameters (0x12).'
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2597
'If the advertising set's Own_Address_Type parameter is set to 0x03,
the controller's resolving list did not contain a matching entry, and
the random address for the advertising set has not been initialized,
the Controller shall return the error code Invalid HCI Command
Parameters (0x12).' |
Luiz Augusto von Dentz |
4 years ago |
1 file, +44, -0 |
| a12c96c2 |
src/adv_monitor: Remove checking in device lost timeout
The time check in device lost timeout could cause DeviceLost never being
reported because of the following reasons:
1. Timer created in timeout_add_seconds, which calls
g_timeout_add_seconds_full internally, can be fired one second
earlier than |timeout| seconds.
2. When handle_device_lost_timeout is invoked early, time diff between
|curr_time| and |last_seen| could be less than |low_rssi_timeout|. In
this case, since handle_device_lost always returns FALSE, the
timer will be removed, but DeviceLost has not been reported yet.
3. If we never receives any advertisement from that peer since then,
DeviceLost will never be reported.
We can remove the checking in handle_device_lost_time because we restart
or remove the timer whenever an advertisement is received.
Reviewed-by: apusaka@chromium.org
Reviewed-by: mcchou@chromium.org
Reviewed-by: mmandlik@chromium.org |
Yun-Hao Chung |
4 years ago |
1 file, +6, -21 |
| e1432e7b |
Release 5.60 |
Marcel Holtmann |
4 years ago |
2 files, +9, -1 |
| 33b9f85d |
profile: Fail RegisterProfile if UUID already exists
If a process tries to register a profile implementation that is already
registered, RegisterProfile should fail.
This should help address issues when two instances of PulseAudio are
running at the same time, and the second instance tries to register an
audio profile implementation that has already been registered by the
first instance. Two situations where this may happen is when more than
one user is logged in, or during the transition between the GDM session
and the user session, when PulseAudio gets started on the new session
before the old session has been fully terminated.
https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/303
https://gitlab.gnome.org/GNOME/gdm/-/issues/486 |
João Paulo Rechi Vita |
4 years ago |
1 file, +30, -0 |
| 77dba3b4 |
emulator/btdev: clean up the queue before closing the test
This patch clean up the queue for connection before closing the test to
prevent the potential memory leak.
==50== 32 bytes in 1 blocks are definitely lost in loss record 18 of 32
==50== at 0x483A809: malloc (vg_replace_malloc.c:307)
==50== by 0x14A37E: btd_malloc (util.c:33)
==50== by 0x149D9D: queue_new (queue.c:47)
==50== by 0x13B3C0: btdev_create (btdev.c:6042)
==50== by 0x13178E: create_vhci (hciemu.c:229)
==50== by 0x13178E: hciemu_new_num (hciemu.c:403)
==50== by 0x130E2C: read_index_list_callback (mgmt-tester.c:357)
==50== by 0x14AD91: request_complete (mgmt.c:264)
==50== by 0x14BD34: can_read_data (mgmt.c:356)
==50== by 0x14E794: watch_callback (io-glib.c:157)
==50== by 0x48B578E: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.6400.6)
==50== by 0x48B5B17: ??? (in /usr/lib64/libglib-2.0.so.0.6400.6)
==50== by 0x48B5E32: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.6400.6)
==50==
==50== 32 bytes in 1 blocks are definitely lost in loss record 19 of 32
==50== at 0x483A809: malloc (vg_replace_malloc.c:307)
==50== by 0x14A37E: btd_malloc (util.c:33)
==50== by 0x149D9D: queue_new (queue.c:47)
==50== by 0x13B3C0: btdev_create (btdev.c:6042)
==50== by 0x1318F7: hciemu_client_new (hciemu.c:332)
==50== by 0x1318F7: hciemu_new_num (hciemu.c:412)
==50== by 0x130E2C: read_index_list_callback (mgmt-tester.c:357)
==50== by 0x14AD91: request_complete (mgmt.c:264)
==50== by 0x14BD34: can_read_data (mgmt.c:356)
==50== by 0x14E794: watch_callback (io-glib.c:157)
==50== by 0x48B578E: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.6400.6)
==50== by 0x48B5B17: ??? (in /usr/lib64/libglib-2.0.so.0.6400.6)
==50== by 0x48B5E32: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.6400.6) |
Tedd Ho-Jeong An |
4 years ago |
1 file, +4, -1 |
| a19b0d59 |
test-runner: Use src/main.conf if available
This makes use of src/main.conf as configuration file that way custom
options can be applied while running the daemon. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +8, -2 |
| 10d1acb1 |
shared/gatt-client: Fix GATT client attribute read with offset
bluez always replies the whole value despite a user specify the offset.
This patch fixes the issue.
Reviewed-by: sonnysasaka@chromium.org |
Howard Chung |
4 years ago |
1 file, +4, -2 |
| 5c761257 |
adapter: Fix toggling of experimental features
When toggling experimental features it may cause the old value to still
be in effect since it was read after read info which upon completion
would attempt to call adapter_register without first updating the
experimental features which could affect the likes of advertising
instances when LL Privacy is enabled. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +11, -10 |
| b3451a20 |
doc/advmon-api: Clarify Patterns property
The Patterns property description was not as clear as it could be. This
expands the text a bit, replaces the C enum value 0x01 with the D-Bus
property string value "or_patterns" and improves the grammar in a few
places. |
David Lechner |
4 years ago |
1 file, +4, -3 |
| 9b9da919 |
adv_monitor: Avoid skipping non-discoverable dev on Monitor match
Do no skip a non-discoverable device if it matches any Advertisement
Monitor.
Reviewed-by: mcchou@google.com
Reviewed-by: alainmichaud@google.com |
Manish Mandlik |
4 years ago |
1 file, +1, -1 |
| ee0f3c03 |
media: Fix UnregisterApplication
UnregisterApplication is not doing anything since the apps queue is
never initialized which results in not finding any application when
unregistering.
Fixes: https://github.com/bluez/bluez/issues/126 |
Luiz Augusto von Dentz |
4 years ago |
1 file, +3, -0 |
| c939747f |
rfkill: Fix reading from rfkill socket
The kernel will always send exactly one event, but the size of the
passed struct will depend on the length of the submitted read() and the
kernel version. i.e. the interface can be extended and we need to expect
for a read to be longer than expected if we ask for it.
Fix this by only requesting the needed length and explicitly check the
length against the V1 version of the structure to make the code a bit
more future proof in case the internal copy of the struct is updated to
contain new fields. |
Benjamin Berg |
4 years ago |
1 file, +11, -13 |
| 4da8cec3 |
tools/mgmt-tester: Update to support multiple extended adv instances
This patch updates to align with the multiple extended advertising
support. |
Tedd Ho-Jeong An |
4 years ago |
1 file, +13, -23 |
| 468d6f11 |
emulator/bthost: Create ext adv params before setting adv data
Based on the SPEC 5.2 Vol 4, Part E, Section 7.8.54, the
LE_Set_Extended_Advertising_Data_Command may be issued after an
advertising set identifed by the Advertising_Handle has been created
using the HCI_LE_Set_Extended_Advertising_Parameters command. |
Tedd Ho-Jeong An |
4 years ago |
2 files, +21, -6 |
| d9979f26 |
emulator/btdev: Add support HCI LE Adv Set Terminated event
This patch adds support the HCI_LE_Advertising_Set_Terminated event in
btdev. |
Luiz Augusto von Dentz |
4 years ago |
2 files, +62, -3 |
| 5145b1ea |
emulator/btdev: Add support multiple instance of extended advertising
This patch adds support multiple instance of extended advertising. |
Tedd Ho-Jeong An |
4 years ago |
2 files, +324, -96 |
| f5cc75fc |
tools/mgmt-tester: Enable High-Speed(HS) test cases
This patch enables the BT High-Speed(HS) test cases by enabling the HS
in the kernel config. |
Tedd Ho-Jeong An |
4 years ago |
2 files, +6, -5 |
| 864d0372 |
device: Fix enabling temporary timer when TemporaryTimeout=0
When TemporaryTimeout is set to 0 it is supposed to disable the
temporary timeout so devices never desappear.
Fixes: https://github.com/bluez/bluez/issues/146 |
Luiz Augusto von Dentz |
4 years ago |
1 file, +25, -23 |
| 0388794d |
avdtp: Fix parsing capabilities
This patch fixes size comparison and variable misassignment.
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Michael Sun <michaelfsun@google.com> |
Archie Pusaka |
4 years ago |
1 file, +2, -2 |
| dda85ae7 |
monitor: Adding missing device found flag in the parser
A new flag was added to the kernel implementation of the Device Found
event, but had not been added to the parser leading to an "Unknown device
flag" error in btmon.
Reviewed-by: Yu Liu <yudiliu@google.com> |
Alain Michaud |
4 years ago |
1 file, +4, -3 |
| 40f996c6 |
gatt-client: Check length of notify multiple op
Check that specfied length of value in received data does not exceed
length of PDU. Otherwise data may be read from beyond the end of the
buffer. |
Sebastian Urban |
4 years ago |
1 file, +3, -0 |
| 352cee47 |
mgmt-tester: Fix typo
This fixes debup typo. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +2, -2 |
| c3db40ee |
monitor: Fix typos
This fixes interval typos. |
Luiz Augusto von Dentz |
4 years ago |
1 file, +2, -2 |
| 2c405706 |
doc: Add initial draft of security bugs handling document |
Marcel Holtmann |
4 years ago |
1 file, +88, -0 |
| 6278a710 |
gatt-database: No multiple calls to AcquireWrite
This checks if an outstanding call to AcquireWrite is already in
progress. If so, the write request is placed into the queue, but
AcquireWrite is not called again. When a response to AcquireWrite is
received, acquire_write_reply sends all queued writes over the acquired
socket.
Making multiple simultaneous calls to AcquireWrite makes no sense,
as this would open multiple socket pairs and only the last returned
socket would be used for further writes. |
Sebastian Urban |
4 years ago |
1 file, +33, -8 |
| 297fa5cb |
gatt-server: Flush notify multiple buffer when full and fix overflow
This fixes the calculation of available buffer space in
bt_gatt_server_send_notification and sends pending notifications
immediately when there is no more room to add a notification.
Previously there was a buffer overflow caused by incorrect calculation
of available buffer space: data->offset can equal data->len
from a previous call to this function, leading
(data->len - data->offset) to underflow after data->offset += 2. |
Sebastian Urban |
4 years ago |
1 file, +36, -7 |