| d4679ffa |
advertising: Fix dbus response for over-advertising
client_free would always send a dbus method_return to fix the case where
a request to Unregister occurred before the MGMT call returned. However,
in the code path where too many advertisements are registered, this
method_return prevents the failure from being sent properly. This patch
makes sure the reference to the register_advertisement DBusMessage is
not stored in the client structure until the end of
register_advertisement. This ensures that we only respond once, either
in register_advertisement or in client_free, not both.
It also changes the dbus response in the fast unregister_advertisement
case from a method_return to a btd_error_failed, since the registration
was never allowed to complete, and thus was not successful.
The patch was tested in the following ways:
To verify it did not break the segfault fix in
caff2b48ca54bbc57b5da3f63317767489aa5b48, I repro'd the failure by
quickly unregistering after registering, and verified that the segfault
is still fixed with this change.
Ran through our automated tests that register too many advertisements
and verify that the registration fails with the intended "Maximum
Advertisements Reached" error response. |
Daniel Winkler |
5 years ago |
1 file, +8, -4 |
| 8ecfe322 |
mesh: fix double-free of outbound tx data
Due to the asyncronous multi-step process to send a packet on an HCI
socket, an outbound packet could be superseded before send procedure
is completed. This change ensures that at any stage in the process,
that the pointer to the packet has been fully disposed. |
Brian Gix |
5 years ago |
1 file, +31, -21 |
| 602e4c0f |
mesh: Don't add config server when loading from storage
Adding a sonfig server model when loading from storage is unnecessary,
since the daemon-generated stored configuration always contains
config server model.
This also fixes a memory leak caused by bad parameters passed to
mesh_model_add() |
Inga Stotland |
5 years ago |
1 file, +0, -3 |
| 2614f2b7 |
mesh: Make mesh config model binding API consistent
This changes the order of function arguments in
mesh_config_model_binding_add() and mesh_config_model_binding_del()
to make them consistent with the rest of mesh_config_model... APIs |
Inga Stotland |
5 years ago |
3 files, +6, -6 |
| 8ea7d584 |
mesh: Fix model ID prior to calling mesh config functions
Model IDs for SIG defined models need to be stripped off SIG_VENDOR
value used for internal housekeeping prior to calling functions
that save new model state in node configuration.
Also, remove duplicate statements for model lookup in node config. |
Inga Stotland |
5 years ago |
2 files, +9, -10 |
| fd45d85a |
mesh: Fix encoding of Config Key Refresh Phase Status
Config Key Refresh Phase Status is 4 octets long (see Mesh Profile
v1.0.1, section 4.3.2.60): 1 octet for status, 2 octets for net key
index, 1 octet for the phase. |
Michał Lowas-Rzechonek |
5 years ago |
1 file, +3, -3 |
| 14b109f1 |
mesh: Fix logic error when saving model subscriptions
This fixes opcode check condition when saving configuration for model
subscriptions: use || instead of && for opcode checking |
Inga Stotland |
5 years ago |
1 file, +1, -1 |
| d3691ce6 |
mesh: Fix element index look up for config model subs
Use element address for looking up element index (subscription
address was erroneously used to perform the lookup). |
Inga Stotland |
5 years ago |
2 files, +10, -8 |
| 32f2c108 |
mesh: Fix application key binding lookup
Because l_queue_find can't distinguish between entry->data equal to zero
and missing entry, has_binding() fails when we bind app key with index
0, via L_UINT_TO_PTR.
Bug has been introduced in commit 1a2a6debd |
Michał Lowas-Rzechonek |
5 years ago |
1 file, +7, -1 |
| c77bb848 |
mesh: Refactor heartbeat pub/sub
Move heartbeat publication/subscription timers and housekeeping
to net.c since this is where the trigger events and control messages
are handled. Configuration server (cfgmod-server.c) stays
responsible for parsing the set pub/sub message parameters and
assemblying the pub/sub status messages.
Also, make sure that the correct message status is reported. |
Inga Stotland |
5 years ago |
3 files, +328, -300 |
| 1836a4e0 |
mesh: Clean up handling of config KR phase messages
This modification allows using a single point for sending out
the composed status messages by the Config Server.
Also, this checks for the correct relationship between KR transition
and KR phase values. Correct error codes are sent on unsuccessful
requests and malformed requests are ignored. |
Inga Stotland |
5 years ago |
4 files, +65, -63 |
| 639dabe1 |
mesh: Clean up handling of config net transmit messages
This modification allows using a single point for sending out
the composed status messages by the Config Server. |
Inga Stotland |
5 years ago |
1 file, +23, -15 |
| 91d25c11 |
mesh: Clean up handling of config poll timeout message
This modification allows using a single point for sending out
the composed status messages by the Config Server. |
Inga Stotland |
5 years ago |
2 files, +24, -12 |
| 531806c3 |
mesh: Clean up handling of config relay messages
This modification allows using a single point for sending out
the composed status messages by the Config Server. |
Inga Stotland |
5 years ago |
1 file, +22, -10 |
| 000cd8e3 |
mesh: Clean up handling of config net and app key messages
This modification allows using a single point for sending out
the composed status messages by the Config Server. |
Inga Stotland |
5 years ago |
1 file, +83, -72 |
| 14572fe1 |
mesh: Clean up handling of config publication messages
This modification allows using a single point for sending out
the composed status messages by the Config Server.
Also, return Feature Not Supported errror code when credential
flag is set, but the node does not support LPN feature |
Inga Stotland |
5 years ago |
3 files, +46, -62 |
| 72f85660 |
mesh: Clean up handling of config node identity message
This modification allows using a single point for sending out
the composed status messages by the Config Server. |
Inga Stotland |
5 years ago |
1 file, +4, -11 |
| 1a2a6deb |
mesh: Clean up handling of config model binding messages
This modification allows using a single point for sending out
the composed status messages by the Config Server.
Also, remove unused definitions for binding functions in node.h |
Inga Stotland |
5 years ago |
4 files, +45, -112 |
| 5a12b9b7 |
mesh: Clean up handling of config subscription messages
This provides better functional grouping based on whether a group or
a virtual label is used for the subscription address.
Also, use a single point for sending out the composed Config Server
status messages. |
Inga Stotland |
5 years ago |
5 files, +296, -298 |
| ca5dfd4e |
mesh: Use correct TTL value to send model publication
When sending model publishing data, use TTL value configured for
that publication instead of the default TTL value used for regular
messages. |
Inga Stotland |
5 years ago |
3 files, +7, -10 |
| 347117af |
mesh: Allow deleting non-existing net key
When deleting a non-existing key, first check that it doesn't exist (and
return success), then verify it's not the last key we have. |
Michał Lowas-Rzechonek |
5 years ago |
1 file, +4, -4 |
| 7b25497c |
mesh: Allow deleting non-existing app key
Mesh Profile v1.0.1, section 4.3.2.40 Config AppKey Status
(...) The Status Code shall be Success if the received request was
redundant (add of an identical existing key, update of an identical
updated key, or delete of a non-existent key), with no further action
taken. |
Michał Lowas-Rzechonek |
5 years ago |
1 file, +1, -1 |
| ab7ad583 |
avrcp: include all player settings in notif event
According to AVRCP 1.6.2 spec section 6.7.2 table 6.39, all player
application settings should be returned to the CT and let CT to
determine which settings have changed. Currently bluez only returns
the changed attribute instead. This patch also addresses a potential
issue on which the number of application settings mismatches with
the actual number returned. |
Howard Chung |
5 years ago |
1 file, +32, -39 |
| d262eda1 |
mesh: Add strings for SIG Model IDs |
Michael N. Moran |
5 years ago |
4 files, +70, -3 |
| bd1b1d9e |
input/device: Send UHID_DESTROY upon disconnection
According to the uhid documentation: "If your device disconnects,
you should send an UHID_DESTROY event" |
Archie Pusaka |
5 years ago |
1 file, +28, -1 |
| 41400986 |
input/device: Implement handle for UHID_SET_REPORT
This patch listens to UHID_SET_REPORT event and forwards this
message to the hid device. Upon reply, we also send a report back
to the kernel as UHID_SET_REPORT_REPLY.
hidp_send_set_report no longer listen UHID_OUTPUT events, that is
handled by hidp_send_output instead. |
Archie Pusaka |
5 years ago |
1 file, +76, -24 |
| 646db717 |
input/device: Replace UHID_FEATURE with UHID_GET_REPORT
According to kernel's uhid.h, UHID_FEATURE is obsolete and is
replaced with UHID_GET_REPORT. |
Archie Pusaka |
5 years ago |
2 files, +22, -21 |
| e170ce6f |
mesh: Fix calculation of model publication period
This fixes the extraction of bit fields from model publication
period octet received as part of Congif Publication Set message.
The step resolution field is extracted as upper 2 bits (shift by 6)
and the number of steps field is extracted by masking lower 6 bits. |
Inga Stotland |
5 years ago |
1 file, +8, -7 |
| 81cba0be |
mesh: Add guard against wedging outbound queue
When using HCI command chains, the first packet send that starts an
outbound sequence needs to still exist when command chain completes, or
the outbound queue will wedge. The simplest solution is to send packets
at least twice on an empty queue, if there is a chance it could be canceled. |
Brian Gix |
5 years ago |
1 file, +8, -0 |
| a081a337 |
input: Remove bonding info when receiving virtual cable unplug
From Bluetooth HID Profile 1.1 Spec: If a Virtual Cable is
unplugged via a HID control Virtual Unplug command, then both the
Bluetooth HID device and Bluetooth HID Host shall destroy or
invalidate all Bluetooth bonding and Virtual Cable information
that was previously stored in persistent memory for the respective
Virtually Cabled devices and hosts.
This patch removes the bonding information upon receiving and/or
sending a "virtual cable unplug". |
Archie Pusaka |
5 years ago |
1 file, +22, -1 |
| cfe249a5 |
device: add device_remove_bonding function
This patch splits the "bonding removal" function in device.c,
because we need to remove bonding information when receiving
"virtual cable unplug" in HID profile. |
Archie Pusaka |
5 years ago |
2 files, +19, -10 |
| 4a452057 |
main: add missing comma after AlwaysPairable
Commit 1880b2990866 ("core: Add AlwaysPairable to main.conf") added a new
key to supported_options but didn't add a comma. This leads to the
following error message on startup if the key 'PairableTimeout' is pesent:
Unknown key PairableTimeout for group General in /etc/bluetooth/main.conf
This probably also leads to ignoring the setting.
Fixes: 1880b2990866 ("core: Add AlwaysPairable to main.conf") |
Michael Nosthoff |
5 years ago |
1 file, +1, -1 |
| 81a0868b |
mesh: Move model functionality out of node.c to model.c
This moves the model related code out of node.c to model.c providing
for better functional separation of modules.
Also, use the value of 0xFFFF for internal representation of vendor ID
for BT SIG defined models. This allows to maintain a single internal
vendor ID / model ID space. |
Inga Stotland |
5 years ago |
7 files, +544, -578 |
| e9db825e |
mesh: Fix memory leak on provisioning timeout
If the Provision Acceptor times out without completing successfully, the
timer it was using was never freed. |
Brian Gix |
5 years ago |
1 file, +1, -0 |
| 0fe68138 |
input: encrypt on receive conn req if classic_bonded_only
According to bluetooth HID1.1 spec, section 5.4.3.5.3:
If the Bluetooth HID Host is bonded to a Bluetooth HID device:
If encryption is not already enabled, the Bluetooth HID Host shall
enable encryption with the Bluetooth HID device before sending an
L2CAP Connect Response with a result code of “Connection Successful”
(0x0000) after an L2CAP Connect Request is received.
This patch raises the security level to medium when listening for
incoming connection if the flag classic_bonded_only is set,
effectively starting encryption. |
Archie Pusaka |
5 years ago |
3 files, +10, -2 |
| ae39716c |
input: authenticate when connecting to a bonded device
According to bluetooth HID1.1 spec, part 5.4.3.4.3:
If the Bluetooth HID Host is bonded to a Bluetooth HID device:
If encryption is not already enabled, the Bluetooth HID Host shall
enable encryption with the Bluetooth HID device before sending an
L2CAP Connect Request to open the HID L2CAP Control channel.
When creating connection, this patch checks whether the target
device is bonded, if yes then we use the medium security level
instead of the low one to enable encryption. |
Archie Pusaka |
5 years ago |
1 file, +16, -5 |
| 4b6153b0 |
audio/transport: supply volume on transport init
Sometimes the response of RegisterNotification for volume change
event came before we create the transport for the corresponding
device. If that happens, the volume will be stuck to an
uninitialized invalid value. The property Volume of
MediaTransport1 will also be left unaccessible.
This patch supplies the initial volume when creating a new
transport. The value is obtained from the media_player object.
However, since the avrcp session might not be created by the time
the transport is created, we also try to initialize the volume
when creating avrcp session. |
Archie Pusaka |
5 years ago |
5 files, +77, -16 |
| d1f3beaa |
audio/transport: change volume to 8bit
The valid range of volume is 0 - 127, yet it is stored in 16bit
data type. This patch modifies it so we use 8bit data type to
store volume instead. Furthermore we also use signed type, so
negative values can be used to indicate invalid volume. |
Archie Pusaka |
5 years ago |
5 files, +56, -53 |
| c53e232f |
adapter: Don't remove temporary devices on disconnect
This makes the disconnect logic just update last seen field of the
device so in case it is temporary it would trigger its timer and be
removed after the timeout which is consistent with the discovery
session givin a grace time for application to react to such events. |
Luiz Augusto von Dentz |
5 years ago |
2 files, +2, -7 |
| 18e137db |
tools/mesh-cfgclient: Fix segfault on remote node reset
This fixes a segfault that is caused by freeeing non-allocated memory.
Happens upon the removal of a remote node when remote's net key and/or
app key queues are destroyed.
__GI___libc_free (mem=0x1) at malloc.c:3102
destroy=destroy@entry=0x55761f63a3b0 <l_free>) at ell/queue.c:107
destroy=destroy@entry=0x55761f63a3b0 <l_free>) at ell/queue.c:82
at tools/mesh/remote.c:140
at tools/mesh/cfgcli.c:764
at tools/mesh/cfgcli.c:764
msg=0x5576213aa6f0, user_data=<optimized out>)
at tools/mesh-cfgclient.c:1522
dbus=dbus@entry=0x55762132f860, message=message@entry=0x5576213aa6f0)
at ell/dbus-service.c:1793
user_data=0x55762132f860) at ell/dbus.c:285
user_data=0x55762132f940) at ell/io.c:126 |
Inga Stotland |
5 years ago |
1 file, +3, -2 |
| 6ea1b038 |
device: Fix not removing temporary timer when connected
Devices with random addresses will not have its temporary flag (as they
cannot be persisted in storage) reset even in case they are connected
which could cause and unintended disconnection. |
Luiz Augusto von Dentz |
5 years ago |
1 file, +6, -0 |
| fac14943 |
shared/gatt-client: Consolidate code parsing services
This makes code parsing primary/secondary services which was mostly
duplicated into a function so it can be reused. |
Luiz Augusto von Dentz |
5 years ago |
1 file, +50, -67 |
| 55fbe240 |
shared/gatt-client: Fix possible crash
This fixes the following crash which was the cause of CI failing with
the latest changes:
Invalid read of size 8
at 0x15A5ED: queue_remove_if (queue.c:289)
by 0x15181E: chrc_removed (gatt-client.c:278)
by 0x15A4BC: queue_foreach (queue.c:220)
by 0x157870: notify_attribute_changed (gatt-db.c:396)
by 0x157870: notify_service_changed (gatt-db.c:407)
by 0x15793C: gatt_db_service_destroy (gatt-db.c:433)
by 0x15A741: queue_remove_all (queue.c:354)
by 0x15A774: queue_destroy (queue.c:73)
by 0x15776F: gatt_db_destroy (gatt-db.c:459)
by 0x15776F: gatt_db_unref (gatt-db.c:471)
by 0x15776F: gatt_db_unref (gatt-db.c:463)
by 0x15211A: bt_gatt_client_free (gatt-client.c:2250)
by 0x152565: notify_cb (gatt-client.c:2228)
by 0x14D0F8: handle_notify (att.c:972)
by 0x14D0F8: can_read_data (att.c:1063)
by 0x1597F4: watch_callback (io-glib.c:170)
by 0x48B67AE: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x48B6B37: ??? (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x48B6E52: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x159DE4: mainloop_run (mainloop-glib.c:79)
by 0x15A1C1: mainloop_run_with_signal (mainloop-notify.c:201)
by 0x14B27B: tester_run (tester.c:870)
by 0x147C8E: main (test-gatt.c:4488)
Address 0x4f51498 is 8 bytes inside a block of size 32 free'd
at 0x483B9F5: free (vg_replace_malloc.c:538)
by 0x1520A8: bt_gatt_client_free (gatt-client.c:2235)
by 0x152565: notify_cb (gatt-client.c:2228)
by 0x14D0F8: handle_notify (att.c:972)
by 0x14D0F8: can_read_data (att.c:1063)
by 0x1597F4: watch_callback (io-glib.c:170)
by 0x48B67AE: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x48B6B37: ??? (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x48B6E52: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.6400.3)
by 0x159DE4: mainloop_run (mainloop-glib.c:79)
by 0x15A1C1: mainloop_run_with_signal (mainloop-notify.c:201)
by 0x14B27B: tester_run (tester.c:870)
by 0x147C8E: main (test-gatt.c:4488) |
Luiz Augusto von Dentz |
5 years ago |
1 file, +1, -1 |
| 713f6f09 |
profile: Add exception to battery profile for external access
This gives exception to battery profile to be shared both internally and
externally. |
Sonny Sasaka |
5 years ago |
2 files, +5, -0 |
| d5e07945 |
gatt: Support DeviceInfo Service when vid/pid is specified
This patch adds support for the PNPID characteristic when configured in
main.conf.
This was validated as read correclty both by manually reading the valud
and confirming in the Ellisys Analyzer.
ATT Read (PnP ID: Source=Bluetooth ID, Vendor=224, Product=50181,
ATT Read Response Packet (Source=Bluetooth ID, Vendor=224,
Product=50181, Version=86) | OK | 7 bytes (01 E0 00 05 C4 56 00) |
Alain Michaud |
5 years ago |
1 file, +41, -0 |
| 5fa084b0 |
shared/gatt-client: Fix handling of service changed
When handling multiple service changed multiple discovery operations
would be performed but at the end of each one the hash would be read
which not only would create extra traffic but also prevents the code
to properly detection services disappering. |
Luiz Augusto von Dentz |
5 years ago |
1 file, +4, -2 |
| 6ca0afc4 |
shared/gatt-client: Don't remove active services
If discovery was aborted (i.e due to a disconnect) check if pending
services were active so only staled services which were not completed
fetched are removed. |
Luiz Augusto von Dentz |
5 years ago |
1 file, +4, -0 |
| 0dd2c59b |
shared/gatt-client: Remove notification if its attribute is removed
If the attribute is being removed from the database it means the
notification shall also be dropped, that way users don't have to
cleanup its subscriptions themselves. |
Luiz Augusto von Dentz |
5 years ago |
1 file, +52, -18 |
| 8861aef9 |
shared/gatt-db: Add support for notifying attribute changes
This enables to get notified when an attribute has been changed e.g.
it is being removed so the code can detect changes changes at attribute
level. |
Luiz Augusto von Dentz |
5 years ago |
2 files, +111, -0 |
| 1cd644db |
shared/att: Fix possible crash on disconnect
If there are pending request while disconnecting they would be notified
but clients may endup being freed in the proccess which will then be
calling bt_att_cancel to cancal its requests causing the following
trace:
Invalid read of size 4
at 0x1D894C: enable_ccc_callback (gatt-client.c:1627)
by 0x1D247B: disc_att_send_op (att.c:417)
by 0x1CCC17: queue_remove_all (queue.c:354)
by 0x1D47B7: disconnect_cb (att.c:635)
by 0x1E0707: watch_callback (io-glib.c:170)
by 0x48E963B: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.6400.4)
by 0x48E9AC7: ??? (in /usr/lib/libglib-2.0.so.0.6400.4)
by 0x48E9ECF: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.6400.4)
by 0x1E0E97: mainloop_run (mainloop-glib.c:79)
by 0x1E13B3: mainloop_run_with_signal (mainloop-notify.c:201)
by 0x12BC3B: main (main.c:770)
Address 0x7d40a28 is 24 bytes inside a block of size 32 free'd
at 0x484A2E0: free (vg_replace_malloc.c:540)
by 0x1CCC17: queue_remove_all (queue.c:354)
by 0x1CCC83: queue_destroy (queue.c:73)
by 0x1D7DD7: bt_gatt_client_free (gatt-client.c:2209)
by 0x16497B: batt_free (battery.c:77)
by 0x16497B: batt_remove (battery.c:286)
by 0x1A0013: service_remove (service.c:176)
by 0x1A9B7B: device_remove_gatt_service (device.c:3691)
by 0x1A9B7B: gatt_service_removed (device.c:3805)
by 0x1CC90B: queue_foreach (queue.c:220)
by 0x1DE27B: notify_service_changed.isra.0.part.0 (gatt-db.c:369)
by 0x1DE387: notify_service_changed (gatt-db.c:361)
by 0x1DE387: gatt_db_service_destroy (gatt-db.c:385)
by 0x1DE3EF: gatt_db_remove_service (gatt-db.c:519)
by 0x1D674F: discovery_op_complete (gatt-client.c:388)
by 0x1D6877: discover_primary_cb (gatt-client.c:1260)
by 0x1E220B: discovery_op_complete (gatt-helpers.c:628)
by 0x1E249B: read_by_grp_type_cb (gatt-helpers.c:730)
by 0x1D247B: disc_att_send_op (att.c:417)
by 0x1CCC17: queue_remove_all (queue.c:354)
by 0x1D47B7: disconnect_cb (att.c:635) |
Luiz Augusto von Dentz |
5 years ago |
1 file, +40, -6 |