system-bt

Fork

Android 8.1.0 Release 69 (5794017)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXZfQjQAKCRDorT+BmrEO
eGnsAJ9Ue4ZRZUiakMPdUIv9+AR2wt22zwCfW+VFvdTeQDvImdf1rOO35Gt8KNE=
=ZgTw
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r69' into oreo-x86

Android 8.1.0 Release 69 (5794017)

Conflicts:
stack/btu/btu_hcif.cc
stack/sdp/sdp_discovery.cc

Fall back to CLOCK_BOOTTIME if CLOCK_BOOTTIME_ALARM fails

If the cuttlefish device does not have an rtc device (such as the crosvm
VMM) the bt osi layer can promote crashes due to it not being able to
create a CLOCK_BOOTTIME_ALARM timer. Bring back a fallback but enable it
at runtime instead of compile time.

Bug: 126955943
Test: run with cuttlefish
Change-Id: I3ab0282b3e8fde776aa7b37d5772c8f62cf957bf

Revert "DO NOT MERGE Separate SDP procedure from bonding state (1/2)"

This reverts commit 1df6bcbe986e783b486789d07afe35c47c2658ae.

DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size

If remote device stop the encryption before we call "Read Encryption Key Size",
we might receive Insufficient Security, which means that link is no longer
encrypted.

In such cases we should stay connected, rather than disconnecting the
link.

Test: Connect to device that stop encryption right after encryption is
complete, i.e. to change roles.
Bug: 124301137
Bug: 132626699

Change-Id: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Merged-In: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
(cherry picked from commit bdac7b911f710c9c323af60b93eeda045881b5e6)

DO NOT MERGE Separate SDP procedure from bonding state (1/2)

- Do not stay in bonding state if the device is paried but still
discovering service.
- Report BOND_BONDED to Java after authentication for a classic
Bluetooth device is completed.
- Send BONDING event to Java when static identity address is
first obtained during crosskey pairing
- Send BONDING event to Java for the initial random address
before send BONDED event
- Do not send bond event for static identity address when SDP is done.
- Make sure pairing control block always get cleaned up when both SDP
and pairing are done
- Send empty UUIDs to Java layer to unblock bonding intent broadcast
when SDP fails

Bug: 79703832
Test: runtest bluetooth, regression test
Change-Id: I8a98ba2178039e25c65fc701855066a8788312e6
(cherry picked from commit 9d5a28a536f3c2ce45e6fb7c5a0b78ec1802f006)

Android 8.1.0 release 65
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXPGt7AAKCRDorT+BmrEO
eFv+AJ0SJfS84jRefbEsWwbmCP2Y1dsz3ACeKB2fryFj0j3Nds5WsChBb3YHqxk=
=kTQ5
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r65' into oreo-x86

Android 8.1.0 release 65

Support generic USB Bluetooth adapter

Find USB Bluetooth adapter according to device class and subclass.
See https://www.usb.org/defined-class-codes#anchor_BaseClassE0h.

hciblecmds: remove unnecessary checking

This fixes Bluetooth USB dongle support.

Replace Bluetooth HAL by Intel's implementation

Linaro's implementation is buggy.

Add back libbt-vendor

Android 8.1.0 Release 64 (OPM8.190505.001)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXNCVTQAKCRDorT+BmrEO
eKUdAJ98NM0aWKcW1zcZ+3HxCkkojnoZFQCdEWbojvM7+JH+YORTajxV6UsxzOs=
=3EKd
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r64' into oreo-x86

Android 8.1.0 Release 64 (OPM8.190505.001)

DO NOT MERGE: osi: Offload mutex pointer to local scope

Create a shared_ptr for the callback_mutex in the alarm struct.
When performing the callback, make a local shared_ptr reference.
lock_guard on the local shared_ptr reference.

Bug: 117997080
Test: atest net_test_bluetooth
Change-Id: Iab800f720f4ccc4735e4d494e0d458eb97b40a4a
(cherry picked from commit aaa823ae7dbcce43ff9c60e570d5f9583dd9d331)

Fix potential OOB read in sdpu_get_len_from_type

Add boundary check in sdpu_get_len_from_type to prevent potential OOB read.

Bug: 117105007
Test: Manul
Merged-In: I3755e13ee0a7e22ffd5f48fca909610a26b09d0a
Change-Id: I3755e13ee0a7e22ffd5f48fca909610a26b09d0a
(cherry picked from commit 1243f8da338dadfe2a3c281a08297b431402d41c)
(cherry picked from commit 4d8e1d63e1a2116c47702d38d858f5a742e8292f)

Merge cherrypicks of [7293853, 7292376, 7293922] into oc-m8-release

Change-Id: Idcedfcefb63c6a909de08d4ca448ad5405968bee

Revert "DO NOT MERGE Separate SDP procedure from bonding state (1/2)"

This reverts commit f3681c8616af4d052c410ba3e88747541a974bf5.

Bug: 79703832
Bug: 130553855
Reason for revert: Regression with cross-key pairing

Change-Id: If8652936eb3b24b3d1b3fded0be200bb986b70e3
(cherry picked from commit c0c3804acd096a6c0fd3bd50b66c9579fed95a94)

DO NOT MERGE Don't persist bonds using sample LTK

Test: compilation, manual testing
Bug: 128843052
Change-Id: I52fd484d42bf87e96dbc9e6456090f231ed48111
(cherry picked from commit 054dcec1c9b6ac732e7380c5e921407cd316474f)

DO NOT MERGE Drop Bluetooth connection with weak encryption key

This patch requires Bluetooth chip to support HCI Read Encryption Key Size
command and will cause Bluetooth to crash if this command is not supported
on a device. Such device should not take this patch and should look for
alternative solution to drop Bluetooth connection with weak encryption key.

Bug: 124301137
Change-Id: Id4b6b4e765628397a79e6806f45c2cd27acebd5b
(cherry picked from commit e32d4aa7a4b02dd39e918b3b3efae0ccc60ef588)

Merge cherrypicks of [7077328, 7074021, 7074022, 7077576, 7077577, 7077578, 7077579] into oc-m8-release

Change-Id: I13b58695eb4e461c6f451855cd54cd90219b3ca4

DO NOT MERGE Don't persist bonds using sample LTK

Test: compilation, manual testing
Bug: 128843052
Change-Id: I52fd484d42bf87e96dbc9e6456090f231ed48111
(cherry picked from commit 054dcec1c9b6ac732e7380c5e921407cd316474f)

DO NOT MERGE Drop Bluetooth connection with weak encryption key

This patch requires Bluetooth chip to support HCI Read Encryption Key Size
command and will cause Bluetooth to crash if this command is not supported
on a device. Such device should not take this patch and should look for
alternative solution to drop Bluetooth connection with weak encryption key.

Bug: 124301137
Change-Id: Id4b6b4e765628397a79e6806f45c2cd27acebd5b
(cherry picked from commit e32d4aa7a4b02dd39e918b3b3efae0ccc60ef588)

Revert "DO NOT MERGE Separate SDP procedure from bonding state (1/2)"

This reverts commit dc44715a83fcb547a74941ce8eb689ba7f08860f.

Merge cherrypicks of [6452478, 6451642, 6451643, 6453811, 6451644, 6451645, 6453831, 6453851, 6453852, 6453853, 6453854, 6452479, 6452480, 6452481, 6452482, 6452483] into oc-m8-release

Change-Id: Iadc4f830ab9ad69e26c783994413486d31c50c2a

btm_proc_smp_cback: Don't access p_dev_rec if freed

In btm_proc_smp_cback(), return after p_dev_rec is freed in the middle
to prevent use after free

Bug: 120612744
Test: Use ASAN build; connect to a LE device and wait for timeout
Change-Id: Ic9d0eaeb62a1a1b24884146ca82f4104fabc5bac
(cherry picked from commit 953dd279502980b1d8d30656eb78c6445a6e31f7)

DO NOT MERGE Separate SDP procedure from bonding state (1/2)

- Do not stay in bonding state if the device is paried but still
discovering service.
- Report BOND_BONDED to Java after authentication is completed.
- Report empty UUID to Java if a classic Bluetooth device SDP
failed while pairing.
- Hold BOND_BONDED intent util SDP is findished.
- Only accept profile connection for the device is at bonded
state. Any attempt to connect while bonding would potentially
lead to an unauthorized connection.

Bug: 79703832
Test: runtest bluetooth
Change-Id: I023713e07308bfc0e5bb8d67f386bcc50f6a0f85
(cherry picked from commit 122e115b87fe98ca5e5e65b9765c146f9e52b65e)
(cherry picked from commit f3681c8616af4d052c410ba3e88747541a974bf5)

process_l2cap_cmd: Fix OOB

Bug: 119870451
Test: POC
Change-Id: I2f5e7fedd9aed96c4ffc55af79fdac61c2e5b087
Merged-In: I5131bbf9cda6248fdbbc4bb91916b2fe3731246e
(cherry picked from commit 94fd011bc9a72081cc691ed7d6e6eec42e9f4539)

btm_ble_multi_adv: Check data length in HCI interface

For BleAdvertiserVscHciInterfaceImpl and
BleAdvertiserLegacyHciInterfaceImpl, the maximum size of scan response
and advertising packet data length should be BTM_BLE_AD_DATA_LEN (31).

Bug: 121145627
Test: POC
Change-Id: I7653a6c186b7313ef2b1547bca120b9d41c90140
(cherry picked from commit a99fe8a175a6d209e741871544ae3f857c8a7cbb)

btm_proc_smp_cback: Don't access p_dev_rec if freed

In btm_proc_smp_cback(), return after p_dev_rec is freed in the middle
to prevent use after free

Bug: 120612744
Test: Use ASAN build; connect to a LE device and wait for timeout
Change-Id: Ic9d0eaeb62a1a1b24884146ca82f4104fabc5bac
(cherry picked from commit 953dd279502980b1d8d30656eb78c6445a6e31f7)

process_l2cap_cmd: Fix OOB

Bug: 119870451
Test: POC
Change-Id: I2f5e7fedd9aed96c4ffc55af79fdac61c2e5b087
Merged-In: I5131bbf9cda6248fdbbc4bb91916b2fe3731246e
(cherry picked from commit 94fd011bc9a72081cc691ed7d6e6eec42e9f4539)

btm_ble_multi_adv: Check data length in HCI interface

For BleAdvertiserVscHciInterfaceImpl and
BleAdvertiserLegacyHciInterfaceImpl, the maximum size of scan response
and advertising packet data length should be BTM_BLE_AD_DATA_LEN (31).

Bug: 121145627
Test: POC
Change-Id: I7653a6c186b7313ef2b1547bca120b9d41c90140
(cherry picked from commit a99fe8a175a6d209e741871544ae3f857c8a7cbb)

DO NOT MERGE Separate SDP procedure from bonding state (1/2)

- Do not stay in bonding state if the device is paried but still
discovering service.
- Report BOND_BONDED to Java after authentication is completed.
- Report empty UUID to Java if a classic Bluetooth device SDP
failed while pairing.
- Hold BOND_BONDED intent util SDP is findished.
- Only accept profile connection for the device is at bonded
state. Any attempt to connect while bonding would potentially
lead to an unauthorized connection.

Bug: 79703832
Test: runtest bluetooth
Change-Id: I023713e07308bfc0e5bb8d67f386bcc50f6a0f85
(cherry picked from commit 122e115b87fe98ca5e5e65b9765c146f9e52b65e)
(cherry picked from commit f3681c8616af4d052c410ba3e88747541a974bf5)