summaryrefslogtreecommitdiff
path: root/profiles
Commit message (Collapse)AuthorAgeFilesLines
* vcp: Mark driver as experimentalLuiz Augusto von Dentz2023-05-151-9/+9
| | | | | This uses the btd_profile.experimental to mark the driver as experimental.
* mcp: Mark driver as experimentalLuiz Augusto von Dentz2023-05-151-13/+4
| | | | | This uses the btd_profile.experimental to mark the driver as experimental.
* csip: Mark driver as experimentalLuiz Augusto von Dentz2023-05-151-9/+9
| | | | | This uses the btd_profile.experimental to mark the driver as experimental.
* bass: Mark driver as experimentalLuiz Augusto von Dentz2023-05-151-9/+8
| | | | | This uses the btd_profile.experimental to mark the driver as experimental.
* bap: Mark driver as experimentalLuiz Augusto von Dentz2023-05-151-9/+8
| | | | | This uses the btd_profile.experimental to mark the driver as experimental.
* profiles: Add initial code for BASS pluginIulia Tanasescu2023-05-051-0/+305
| | | | This adds initial code for BASS plugin.
* media: Fix not storing Preferred Delay properlyLuiz Augusto von Dentz2023-04-251-2/+2
| | | | | Preferred Delay properties were being stored as qos->pd_* instead of qos->ppd_*.
* bap: add Location parameter to SelectPropertiesPauli Virtanen2023-04-251-0/+6
| | | | | | | | | Add relevant PACS Location field as a parameter to SelectProperties. SelectProperties may set Audio_Channel_Allocation, which shall be chosen from the bits set in Sink/Source Audio Locations (BAP v1.0.1 Sec. 4.4.1, Sec 4.4.2). Hence, audio server needs to know the supported values, which it previously could not.
* Split bt_iso_qos into dedicated structuresIulia Tanasescu2023-03-311-9/+10
| | | | | Split bt_iso_qos into dedicated unicast and broadcast structures and add additional broadcast parameters.
* avrcp: Fix crash while handling unsupported eventsLuiz Augusto von Dentz2023-03-301-0/+6
| | | | | | | | | | | | | | | | | | | | | The following crash can be observed if the remote peer send and unsupported event: ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000148f11 at pc 0x559644552088 bp 0x7ffe28b3c7b0 sp 0x7ffe28b3c7a0 WRITE of size 1 at 0x60b000148f11 thread T0 #0 0x559644552087 in avrcp_handle_event profiles/audio/avrcp.c:3907 #1 0x559644536c22 in control_response profiles/audio/avctp.c:939 #2 0x5596445379ab in session_cb profiles/audio/avctp.c:1108 #3 0x7fbcb3e51c43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43) #4 0x7fbcb3ea66c7 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xaa6c7) #5 0x7fbcb3e512b2 in g_main_loop_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x552b2) #6 0x559644754ab6 in mainloop_run src/shared/mainloop-glib.c:66 #7 0x559644755606 in mainloop_run_with_signal src/shared/mainloop-notify.c:188 #8 0x5596445bb963 in main src/main.c:1289 #9 0x7fbcb3bafd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #10 0x7fbcb3bafe3f in __libc_start_main_impl ../csu/libc-start.c:392 #11 0x5596444e8224 in _start (/usr/local/libexec/bluetooth/bluetoothd+0xf0224)
* bap: Mark devices to auto-connectLuiz Augusto von Dentz2023-03-291-0/+1
| | | | | This makes devices with BAP support to auto-connect once they start advertising.
* bap: Fix not continue selecting if endpoint respond with an errorLuiz Augusto von Dentz2023-03-241-1/+3
| | | | | | If the endpoint respond with an error we shall decrement selecting counter and proceed to check if there is any stream that can be configured.
* audio/transport: Propagate errors from avrcp_set_volume to DBusMarijn Suijten2023-03-211-11/+23
| | | | | | | | | | | | | | | Any error while setting absolute volume on the peer, or notifying the peer of changes was previously going completely unnoticed. Propagate it to the logs and back to the DBus "Volume" property setter so that they aren't misled into thinking that the AVRCP command succeeded. Note that an error is mostly harmless when the setter of the property is an audio sink and the peer the audio source: in this case we're only _notifying_ the peer of the change when it has already been applied on the sink. Also improve the other two error messages to more closely describe what was "invalid" about the argument.
* transport: add CIG/CIS/PHY properties, don't show unset QoS propertiesPauli Virtanen2023-03-171-6/+61
| | | | | | | | Add CIG, CIS, and PHY properties to BAP transport. The other QoS properties are there, and these may also be useful to clients, e.g. to manage CIG/CIS allocation as client. Hide transport QoS properties when they are not configured.
* profiles: Add initial code for csip pluginSathish Narasimman2023-03-101-0/+363
| | | | | | This adds initial code for csip plugin which handles Coordinated set identification Profile and Coordinated Set Identification Service.
* bap: Fix crash on unexpected disconnectLuiz Augusto von Dentz2023-03-021-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If an unexpected disconnect happens while bt_bap_config is pending the following trace can be observed, to fix it bt_bap_config is reworked so it no longer attempts to create and config the stream in place, instead it just return the new stream and the function is renamed to bt_bap_stream_new: Invalid write of size 4 at 0x3980D8: config_cb (bap.c:395) by 0x4DF5A3: bap_req_complete (bap.c:3471) by 0x4E9D33: bap_req_detach (bap.c:3807) by 0x4E9D33: bt_bap_detach (bap.c:3819) by 0x4E9D33: bt_bap_detach (bap.c:3810) by 0x397AA9: bap_disconnect (bap.c:1342) by 0x4223E0: btd_service_disconnect (service.c:305) by 0x4974D8F: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.7200.3) by 0x438FC3: att_disconnected_cb (device.c:5160) by 0x49A6C6: queue_foreach (queue.c:207) by 0x4B463B: disconnect_cb (att.c:701) by 0x5054DF: watch_callback (io-glib.c:157) by 0x495BFAE: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.7200.3) by 0x49B12C7: ??? (in /usr/lib64/libglib-2.0.so.0.7200.3) Address 0x6576940 is 96 bytes inside a block of size 112 free'd at 0x48480E4: free (vg_replace_malloc.c:872) by 0x48F78D: remove_interface (object.c:660) by 0x490489: g_dbus_unregister_interface (object.c:1394) by 0x397BA8: ep_remove (bap.c:1330) by 0x49ACF4: queue_remove_if (queue.c:279) by 0x49B0AC: queue_remove_all (queue.c:321) by 0x397A7C: bap_disconnect (bap.c:1339) by 0x4223E0: btd_service_disconnect (service.c:305) by 0x4974D8F: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.7200.3) by 0x438FC3: att_disconnected_cb (device.c:5160) by 0x49A6C6: queue_foreach (queue.c:207) by 0x4B463B: disconnect_cb (att.c:701) Block was alloc'd at at 0x484586F: malloc (vg_replace_malloc.c:381) by 0x49B432: util_malloc (util.c:43) by 0x39A1D9: ep_register (bap.c:563) by 0x39A1D9: pac_found (bap.c:664) by 0x4E5FEA: bap_foreach_pac (bap.c:3980) by 0x4EA437: bap_notify_ready (bap.c:2736) by 0x4EA437: bap_idle (bap.c:3711) by 0x4B52F0: idle_notify (gatt-client.c:171) by 0x49ACF4: queue_remove_if (queue.c:279) by 0x49B0AC: queue_remove_all (queue.c:321) by 0x4C092C: notify_client_idle (gatt-client.c:180) by 0x4C092C: request_unref (gatt-client.c:199) by 0x4AACB5: destroy_att_send_op (att.c:209) by 0x4B2B88: handle_rsp (att.c:862) by 0x4B2B88: can_read_data (att.c:1052) by 0x5054DF: watch_callback (io-glib.c:157)
* media: Fix not checking BREDR support for A2DPLuiz Augusto von Dentz2023-03-021-3/+8
| | | | | | A2DP shall depend on MGMT_SETTING_BREDR setting so the likes of bluetoothctl -e don't attempt to register A2DP with controller that are on LE only mode.
* audio/transport: update BAP transport QOS values when changedPauli Virtanen2023-02-211-19/+43
| | | | | | | | | | | Currently, BAP transport publishes on DBus QOS values obtained at transport creation time. For BAP server the transport creation usually occurs before stream QOS is configured, and these values are then all zero. bap->sdu is also never set. Update transport QOS values in DBus when stream state changes. Since nearly all QOS values are exposed in the transport, use bt_bap_qos to store them there for simplicity.
* media: fix ASAN crash in pac_config_cbPauli Virtanen2023-02-151-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't call configuration callback if stream's transport was cleared in the meantime. The clear callback is called just before the stream is freed. Fixes ASAN crash on disconnect while waiting for SetConfiguration DBus reply: ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00002eb90 READ of size 8 at 0x60b00002eb90 thread T0 #0 0x7a4892 in bap_stream_config_cfm_cb src/shared/bap.c:3201 #1 0x4688fb in pac_config_cb profiles/audio/media.c:1010 #2 0x462164 in media_endpoint_cancel profiles/audio/media.c:157 #3 0x462243 in media_endpoint_cancel_all profiles/audio/media.c:165 #4 0x46365b in clear_endpoint profiles/audio/media.c:297 #5 0x463a21 in endpoint_reply profiles/audio/media.c:325 ... freed by thread T0 here: #0 0x7eff644b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388) #1 0x78d8cc in bap_stream_free src/shared/bap.c:974 #2 0x78dbc8 in bap_stream_detach src/shared/bap.c:991 #3 0x78fa43 in bap_stream_state_changed src/shared/bap.c:1210 #4 0x78fe26 in stream_set_state src/shared/bap.c:1254 #5 0x7ab5ce in stream_foreach_detach src/shared/bap.c:3820 #6 0x70ce06 in queue_foreach src/shared/queue.c:207 #7 0x7ab942 in bt_bap_detach src/shared/bap.c:3836 #8 0x51da7a in bap_disconnect profiles/audio/bap.c:1342 #9 0x626e57 in btd_service_disconnect src/service.c:305
* media: look up BAP transports by their associated streamPauli Virtanen2023-02-151-23/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To look up transports, use BAP stream pointers associated with them, not the path strings stored in the stream user data. This makes it clearer that transports presented to the sound server correspond to the actual streams. The Acquire/etc. of BAP transports are already tied to the associated stream. This fixes use-after-free crashes in pac_clear. They occur because the lifetime of the path string was either that of media transport or media endpoint, which may be shorter than that of the BAP stream. In such case, pac_clear is entered with invalid pointer in stream user data, leading to crash. There are a few code paths for this, e.g. making sound server delay its SetConfiguration response (e.g. gdb breakpoint) to get dbus timeout, then disconnecting: ERROR: AddressSanitizer: heap-use-after-free on address XXXX READ of size 3 at 0x606000031640 thread T0 ... #4 0x559891 in btd_debug src/log.c:117 #5 0x46abfd in pac_clear profiles/audio/media.c:1096 #6 0x79fcaf in bap_stream_clear_cfm src/shared/bap.c:914 #7 0x7a060d in bap_stream_detach src/shared/bap.c:987 #8 0x7a25ea in bap_stream_state_changed src/shared/bap.c:1210 #9 0x7a29cd in stream_set_state src/shared/bap.c:1254 #10 0x7be824 in stream_foreach_detach src/shared/bap.c:3820 #11 0x71d15d in queue_foreach src/shared/queue.c:207 #12 0x7beb98 in bt_bap_detach src/shared/bap.c:3836 #13 0x5228cb in bap_disconnect profiles/audio/bap.c:1342 #14 0x63247c in btd_service_disconnect src/service.c:305 freed by thread T0 here: #0 0x7f16708b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388) #1 0x7f167071b8cc in g_free (/lib64/libglib-2.0.so.0+0x5b8cc) #2 0x7047b7 in remove_interface gdbus/object.c:660 #3 0x70aef6 in g_dbus_unregister_interface gdbus/object.c:1394 #4 0x47be30 in media_transport_destroy profiles/audio/transport.c:217 #5 0x464ab9 in endpoint_remove_transport profiles/audio/media.c:270 #6 0x464d26 in clear_configuration profiles/audio/media.c:292 #7 0x464e69 in clear_endpoint profiles/audio/media.c:300 #8 0x46516e in endpoint_reply profiles/audio/media.c:325 ... Fixes: 7b1b1a499cf3 ("media: clear the right transport when clearing BAP endpoint")
* audio/transport: add media_transport_get_stream method for transportsPauli Virtanen2023-02-152-0/+19
| | | | | Add a method for getting the audio stream associated with a media transport.
* media: Check adapter CIS support to add BAP in SupportedUUIDsPauli Virtanen2023-02-131-0/+5
| | | | | Don't indicate BAP support in SupportedUUIDs, if adapter supports neither CIS Central nor Peripheral.
* media: clear the right transport when clearing BAP endpointPauli Virtanen2023-02-131-7/+12
| | | | | | | | | | | Each configured BAP stream is associated with a transport, and only that transport should be cleared when the stream's configuration is cleared. This is required for multiple BAP clients to use the same Media1 endpoint, which is what we should aim for to follow the spirit in which the endpoints work in ASCS. Sound servers generally can handle this, since the *Configuration calls provide the transport paths, and for different clients they are associated with different devices.
* media: set default value for BAP endpoint Vendor fieldPauli Virtanen2023-02-011-0/+2
| | | | | | | | The "Vendor" field is optional, and should have an initialized valid default value. It has the default values in register_endpoint, but not in app_register_endpoint, so make the latter match the former.
* media: Rework support of Vendor to use uint32_t as typeLuiz Augusto von Dentz2023-01-311-20/+17
| | | | This reworks the handlings of Vendor property to use a single uint32_t.
* profiles: Add Support for Metadata, CID and VIDMaheta, Abhay2023-01-313-12/+105
| | | | This adds support for Metadata, Company ID and Vendor Codec ID
* bap: Fix registering multiple endpoint for the same PAC setLuiz Augusto von Dentz2023-01-261-0/+21
| | | | | This makes sure there is only one endpoint representing a local and remote PAC set.
* bap: Fix not removing endpoint if local PAC is unregisteredLuiz Augusto von Dentz2023-01-241-3/+3
| | | | | | | If local PAC is unregistered it would also notify via pac_removed callback which shall unregister the endpoint D-Bus object. Fixes: https://github.com/bluez/bluez/issues/457#issuecomment-1402178691
* bap: Fix not setting stream to NULLLuiz Augusto von Dentz2023-01-231-2/+3
| | | | | | | | | | | | | | | | | If the stream state is idle the ep->stream shall be set to NULL otherwise it may be reused causing the following trace: ==32623==ERROR: AddressSanitizer: heap-use-after-free on address ... READ of size 8 at 0x60b000103550 thread T0 #0 0x7bf7b7 in bap_stream_valid src/shared/bap.c:4065 #1 0x7bf981 in bt_bap_stream_config src/shared/bap.c:4082 #2 0x51a7c8 in bap_config profiles/audio/bap.c:584 #3 0x71b907 in queue_foreach src/shared/queue.c:207 #4 0x51b61f in select_cb profiles/audio/bap.c:626 #5 0x4691ed in pac_select_cb profiles/audio/media.c:884 #6 0x4657ea in endpoint_reply profiles/audio/media.c:369 Fixes: https://github.com/bluez/bluez/issues/457#issuecomment-1399232486
* hog-lib: Fix not handling BT_ATT_OP_HANDLE_NFY_MULTLuiz Augusto von Dentz2023-01-051-2/+21
| | | | | | | | | This is a temporary fix for not handling BT_ATT_OP_HANDLE_NFY_MULT in GAttr so the code will use g_attrib_attach_client to attach the bt_gatt_client instance which is then used to register notifications including those sent with BT_ATT_OP_HANDLE_NFY_MULT. Fixes: https://github.com/bluez/bluez/issues/71
* shared/bap: Make bt_bap_pac_register to be per sessionLuiz Augusto von Dentz2022-12-091-3/+3
| | | | | This makes bt_bap_pac_register to be per session rather than global so the callback don't have to match the session by itself.
* bap: Fix not waiting Endpoint.SelectPropertiesLuiz Augusto von Dentz2022-12-022-31/+54
| | | | | | | If there are multiple Endpoint.SelectProperties wait them to complete before attempting to proceed to configure a stream otherwise streams may not be linked properly and may end up creating multiple CIS instead.
* media: Fix crash when transport configuration changesLuiz Augusto von Dentz2022-12-021-3/+3
| | | | | | | In case of BAP the same transport may be reconfigured multiple times which means it would appears multiple times on endpoint->transports leading to a crash when disconnecting as the code would attempt to destroy the same object multiple times.
* bap: Fix not able to reconfigureLuiz Augusto von Dentz2022-12-021-0/+2
| | | | | | While attempting to configure QoS setting the request id is not reset to 0 when a response is received which prevents any the QoS to be reconfigured.
* profiles: Add initial code for mcp pluginAbhay Maheta2022-10-181-0/+430
| | | | | | | | This adds initial code for mcp plugin which handles Media Control Profile and Generic Media Control Service for Client Role. The plugin exposes dbus methods for media control operations like play, pause which can be invoked using player menu in bluetoothctl.
* Profiles: Enable bt_vcp_set_debugSathish Narasimman2022-09-211-0/+7
| | | | Set bt_vcp_set_debug to be used for VCP.
* profiles: Add initial code for vcp pluginSathish Narasimman2022-09-191-0/+311
| | | | | This adds initial code for vcp plugin which handles Volume Control Profile and Volume Control Service.
* a2dp: Fix not detecting transport connection collisionLuiz Augusto von Dentz2022-09-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some headsets appears to attempt to connect back after receiving AVDTP_Open which would cause unexpected transitions since setup->io and stream->io would not be in sync: > ACL Data RX: Handle 70 flags 0x02 dlen 6 Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0} AVDTP: Open (0x06) Response Accept (0x02) type 0x00 label 2 nosp 0 < ACL Data TX: Handle 70 flags 0x00 dlen 12 L2CAP: Connection Request (0x02) ident 6 len 4 PSM: 25 (0x0019) Source CID: 67 > ACL Data RX: Handle 70 flags 0x02 dlen 12 L2CAP: Connection Request (0x02) ident 10 len 4 PSM: 25 (0x0019) Source CID: 68 < ACL Data TX: Handle 70 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 10 len 8 Destination CID: 68 Source CID: 68 Result: Connection pending (0x0001) Status: Authorization pending (0x0002) < ACL Data TX: Handle 70 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 10 len 8 Destination CID: 68 Source CID: 68 Result: Connection successful (0x0000) Status: No further information available (0x0000) > ACL Data RX: Handle 70 flags 0x02 dlen 16 L2CAP: Connection Response (0x03) ident 6 len 8 Destination CID: 69 Source CID: 67 Result: Connection successful (0x0000) Status: No further information available (0x0000) Fixes: https://github.com/bluez/bluez/issues/327
* shared/bap: Remove include to io.hLuiz Augusto von Dentz2022-09-151-0/+1
| | | | | Users of bap.h shall also include io.h, including io.h by default may cause errors if has been previously included.
* media: Fix scan-build warningsLuiz Augusto von Dentz2022-08-311-5/+16
| | | | | | | | | | | | | | | This fixes the following warnings: profiles/audio/media.c:1465:6: warning: 8th function call argument is an uninitialized value if (media_endpoint_create(adapter, sender, path, uuid, delay_reporting, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ profiles/audio/media.c:3012:3: warning: Use of memory after it is freed release_endpoint(adapter->endpoints->data); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ profiles/audio/media.c:3015:3: warning: Use of memory after it is freed media_player_destroy(adapter->players->data); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* media: Fix registering PAC endpoints if ISO socket are not supportedLuiz Augusto von Dentz2022-08-301-4/+11
| | | | | If adapter don't support ISO sockets the PAC UUIDs shall not be allowed to be registered as they depend on ISO sockets to work properly.
* profiles: Add remote endpoint path to SelectPropertiesFrédéric Danis2022-08-302-3/+14
| | | | | | | This adds the remote endpoint path to the dictionary sent in SelectProperties. It allows audio application to know for which remote endpoint the call is done and so for which it should act as an initiator.
* profiles: Update transport Links property on state change to QoSFrédéric Danis2022-08-291-0/+1
| | | | | | Currently, the Links property is only sent after the first call to the Acquire method, this cmay result in a rejection if a linked transport tries to call the Acquire method before receiving the Links update.
* profiles: Allow linked transport to release the fdFrédéric Danis2022-08-291-0/+43
| | | | | | | Multiple transports can be linked when using LE Audio BAP. In this case only one transport is used to Acquire the file descriptor which will be shared by all linked transports. In the same way, any transport can Release the file descriptor.
* profiles: Add initial code for bap pluginLuiz Augusto von Dentz2022-08-294-47/+2508
| | | | | | This adds initial code for bap plugin which handles Basic Audio Profile, Publish Audio Capabilities Service and Audio Stream Control Service.
* hog-lib: Fix scan-build errorLuiz Augusto von Dentz2022-08-161-0/+9
| | | | | | | | | | | | | | | | This fixes the following errors: profiles/input/hog-lib.c:600:19: warning: Access to field 'handle' results in a dereference of a null pointer (loaded from variable 'chr') report->handle = chr->handle; ^~~~~~~~~~~ profiles/input/hog-lib.c:637:11: warning: Access to field 'value_handle' results in a dereference of a null pointer (loaded from variable 'chr') start = chr->value_handle + 1; ^~~~~~~~~~~~~~~~~ profiles/input/hog-lib.c:1240:11: warning: Access to field 'value_handle' results in a dereference of a null pointer (loaded from variable 'chr') start = chr->value_handle + 1; ^~~~~~~~~~~~~~~~~
* hog-lib: Don't restrict Report MAP sizeLuiz Augusto von Dentz2022-08-161-16/+16
| | | | | | | | | | Although HIDS spec is quite clear the Report MAP shall be limited to 512 bytes it doesn't seem OS do enforce that on the profile/client side and since there isn't any qualification test enforcing it either there are quite many devices which uses Report MAP bigger that 512 bytes (e.g.: Brydge W-Touch and Lenovo Duet 3 BT Folio). https://github.com/bluez/bluez/issues/377
* avdtp: fix possible minor problemslishengyu2022-06-301-1/+4
| | | | | It should always be considered that if send_request fails, sep should be removed from the list and the requested memory freed;
* avdtp: Free discover when send_request returns errorChengyi2022-06-211-0/+3
| | | | | | When send_request returns an error, session->discover should be released here, so that the next time the program enters avdtp_discover, the -EBUSY error will not be returned.
* a2dp: error return paths in a2dp_reconfig must free allocated setupPauli Virtanen2022-06-131-2/+4
|
View Lorry Controller Status