Commits · 5a48f1d2d1e7e831ee36935f538d28d82a216474 · LMODroid / platform_packages_modules_Bluetooth

May 11, 2024

Reland "Enforce authentication if encryption is required" · 5a48f1d2

Hui Peng authored 1 year ago and

Dhina17 committed 10 months ago

While aosp/2863686 was rebased on internal security
fixes, aosp/2865187 was dropped, re-apply it.

Bug: 316244428
Test: m com.android.btservices
Flag: EXEMPT, tested/verfied on internal branches
Change-Id: I319dcfbc9bb9603c515ac0c2c647155211f95e26

5a48f1d2

btm_sec: Class of device regression fix · c0a5763b

William Escande authored 1 year ago and

Dhina17 committed 10 months ago

Bug: 314889276
Fix: 314889276
Test: Manual testing cf b/314889276#comment23
Flag: Exempt, unflag regression fix
Change-Id: I554c9c7b056bb096d3a9609dafe2d96d134f307c

c0a5763b

May 08, 2024

Merge tag 'android-14.0.0_r35' into fourteen · a7cc88d1

Dhina17 authored 10 months ago

Android 14.0.0 release 35

* tag 'android-14.0.0_r35' of https://android.googlesource.com/platform/packages/modules/Bluetooth:
  leaudio: Fix crash on metadata update

Change-Id: I9e42543fb89cb66d8d3b15871782b7695d677e50

a7cc88d1

Apr 01, 2024

[ALPS08619561] Add VSC Cmd for Mediatek chip · 04ee8f63

weifan.zhang authored 1 year ago and

Mohammad Hasan Keramat J committed 11 months ago

[Description]
Add VSC cmd for low latency mode

CR-Id: ALPS08619561

Bug: 309700239
Test: m .
Flag: EXEMPT VSC command

Change-Id: I789b6bddfc6b5661430b399943d1288a7c52e988

04ee8f63

Mar 19, 2024

Merge tag 'android-14.0.0_r29' into fourteen · 476cb392

Dhina17 authored 11 months ago

Android 14.0.0 release 29

 Conflicts:
	service/tests/Android.bp
	system/hci/include/hci_layer.h

Change-Id: I403094ca26ec9c144b010d4291755584e089cad9

476cb392

Mar 15, 2024

Merge cherrypicks of ['googleplex-android-review.googlesource.com/26539688'] into 24Q1-release. · c7a33936
Android Build Coastguard Worker authored 11 months ago
```
Change-Id: I30811d46c0f35bcf8649e534ab5485f657c97bd4
```
c7a33936

leaudio: Fix crash on metadata update · e649021c

Łukasz Rymanowski authored 1 year ago

When moving metadata to Bluetooth mainthread, make sure that Bluetooth
gets metadata and not just a pointer to memory on the stack.

`sink_metadata_v7` contained a pointer to array of either (record|playback)_track_metadata_v7,
so we can't rely on simple struct copy constructor. Pass the array content as vector instead.

Bug: 329067188
Test: mmm packages/modules/Bluetooth
Test: manual LeAudio streaming with different contexs (including call)
Test: atest bluetooth_le_audio_client_test
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c8a5763f89b84a4614bfe21a9de75e07589c6322)
Merged-In: I9c01c81c0094df87efc1b3885ad69d82b0970404
Change-Id: I9c01c81c0094df87efc1b3885ad69d82b0970404

e649021c

Mar 13, 2024

BondStateMachine: Allow skipping confirm for some remotes · a31ff746

Aaron Kling authored 1 year ago and

Dhina17 committed 1 year ago

When pairing two of the Nvidia Shield accessories, a popup would show up
stating that the accessory was an incoming pairing request and needs to
be accepted. The official Nvidia firmware has a whitelist of remotes
that skip this confirmation if pairing request is marked as originating
from the Android device. This change takes a similar approach, but in a
more flexible manner. The main intent is to allow these accessories to
be paired via the pairing intent, which needs to complete with no user
interaction. Previously, the popup would prevent this from succeeding.

Change-Id: Ib5a0226858f5745a20e4cd166500aecdcf1f3354

a31ff746

Feb 11, 2024

Merge tag 'android-14.0.0_r25' of... · 6cfc3499

Mohammad Hasan Keramat J authored 1 year ago

Merge tag 'android-14.0.0_r25' of https://android.googlesource.com/platform/packages/modules/Bluetooth

 into fourteen

Android 14.0.0 Release 25 (UQ1A.240205.004)

Change-Id: Ia67e310ff420ccca525e2a59728e94f8f795c1a6
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

6cfc3499

Bluetooth: Add a workaround for M_RELEASE rsp len in ble_gap.cc · 3c2d6027

AShiningRay authored 1 year ago and

Mohammad Hasan Keramat J committed 1 year ago

Some devices ship with Bluetooth firmware that advertises
compliance with Android M's capabilities but fails certain
requirements such as the minimum expected response length.

This commit introduces an if-else block that allows those devices
to set a system property to bypass that check, fixing Bluetooth in
cases where this check is the only thing impeding it from working.

Change-Id: Ibbf81e922fe75bf0ef5b8cd7197c812348063db5

3c2d6027

Jan 18, 2024

Fix OPP comparison · 14695212

Brian Delwiche authored 2 years ago and

Mohammad Hasan Keramat J committed 1 year ago


isBluetoothShareUri_correctlyCheckUri (under
com.android.bluetooth.opp.BluetoothOppUtilityTest) is failing
on null input due to an incorrect comparison in
isBluetoothShareUri.  Change the comparison to one which can
cope with null input.

Bug: 257190999
Test: atest: BluetoothOppUtilityTest
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I61118f22577de7b975fb0df8dac8583e91f7b8c7
(cherry picked from commit c9b53b95)
Merged-In: I61118f22577de7b975fb0df8dac8583e91f7b8c7
(cherry picked from commit bbbbdb52)
Merged-In: I61118f22577de7b975fb0df8dac8583e91f7b8c7
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

14695212

btm: allow BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE to be adjustable · fdfb9042

Geel authored 1 year ago and

Mohammad Hasan Keramat J committed 1 year ago


Some BCM firmwares shipped with LGE devices will not pass a check involving the BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE capability.

This commit allows BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE to be adjusted as a workaround for these firmwares.
This issue was seen on some v20 and g5 oreo release BCM firmwares and the BCM4358A3_001.004.015.0095.0168_KR_ORC.HCD fw found
on the v20 f800k pie release (lge/elsa_kt_kr/elsa:9/PKQ1.190522.001/20192161159c5)

Log snippet:
```
08-14 11:16:52.534  3468  3468 F DEBUG   : Abort message: '[FATAL:btm_ble_gap.cc(668)] Check failed: p_vcs_cplt_params->param_len >= BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE.
```

Change-Id: I1fccfd0f8877bdc878e7a2068f654369b136956e
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

fdfb9042

gd: hci: Allow disabling selected local commands · fd81c2ab

LuK1337 authored 1 year ago and

Mohammad Hasan Keramat J committed 1 year ago


This allows us to disable selected commands in case they behave in
unexpected ways. e.g. bluetooth.hci.disabled_commands=377 will disable
LE_EXTENDED_CREATE_CONNECTION.

Change-Id: I1fcc624df9fd07200a8406c51772ccb856a4258e
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

fd81c2ab

Add property to disable APCF extended features · 1e028286

0xCAFEBABE authored 1 year ago and

Mohammad Hasan Keramat J committed 1 year ago


* It's broken on some legacy devices, rendering Bluetooth crashing

Change-Id: I4b1764b7551150e78dd8e2dfc99a6472c1293c2b
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

1e028286

gd: hci: Ignore unexpected status events · e15891cb

Peter Cai authored 2 years ago and

Mohammad Hasan Keramat J committed 1 year ago

For some reason, on some old devices, the controller will report a
remote to support SNIFF_SUBRATING even when it does not. Just ignore the
error here (the status event comes from the failure response).

Change-Id: Ifb9a65fd77f21d15a8dc1ced9240194d38218ef6
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

e15891cb

legacy: Split header for hci legacy definitions · 2e0b1eb8

Christian Hoffmann authored 2 years ago and

Mohammad Hasan Keramat J committed 1 year ago


* To expose to c legacy hals
* Like hardware/realtek/rtkbt.

Change-Id: Ic67f9697b032b66a8af364ed41e90d51dc75dd6f
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

2e0b1eb8

bluetooth: abandon app local certificate · 3f01a982

Ji Luo authored 2 years ago and

Mohammad Hasan Keramat J committed 1 year ago


bluetooth app is signed with local certificate ':com.android.bluetooth.certificate'
which is located at 'android/app/certs/*' and is aligned with the certificate in
'build/target/product/security'. However, some vendors may specify their own
certificates path by 'PRODUCT_DEFAULT_DEV_CERTIFICATE' and generate their own
release bluetooth certificates, bluetooth app will fail to load in such scenario
because of the certificate doesn't match and cause selinux error:
  ...
  E SELinux : seapp_context_lookup:  No match for app with uid 1002, seinfo default, name com.android.bluetooth
  E SELinux : selinux_android_setcontext:  Error setting context for app with uid 1002, seinfo default:privapp:targetSdkVersion=33:complete: Success
  ...

This CL use the certificate name 'bluetooth' so the app can be signed with the
same certificate which is located at 'PRODUCT_DEFAULT_DEV_CERTIFICATE/*'.

Test: Bluetooth on&off.

Signed-off-by: Ji Luo <ji.luo@nxp.com>
Change-Id: I286aed5a3b895272f5ffc077ecd1d76351e02af7
Signed-off-by: Mohammad Hasan Keramat J <ikeramat@protonmail.com>

3f01a982

Jan 17, 2024

Merge cherrypicks of ['googleplex-android-review.googlesource.com/25595184',... · 3c788dc0

Android Build Coastguard Worker authored 1 year ago

Merge cherrypicks of ['googleplex-android-review.googlesource.com/25595184', 'googleplex-android-review.googlesource.com/25677276'] into 24Q1-release.

Change-Id: I031bac0d0045537ede0c4ab2583496e2e12a1c4f

3c788dc0

Reland: Fix an OOB write bug in attp_build_value_cmd · f4836971

Hui Peng authored 1 year ago

Bug: 295887535
Bug: 315127634
Test: m com.android.btservices
Test: atest net_test_stack_gatt
Ignore-AOSP-First: security
Flag: EXEMPT, security fix for Q1-2024
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:09e48e0d5377ef56a556f9f05ed3e3e97849475e)
Merged-In: I291fd665a68d90813b8c21c80d23cc438f84f285
Change-Id: I291fd665a68d90813b8c21c80d23cc438f84f285

f4836971

Revert "Fix an OOB write bug in attp_build_value_cmd" · 143d1879

Hui Peng authored 1 year ago

This reverts commit b927f3fb.

Reason for revert: b/315127634
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:074b81c0b0352f254735b6bbd60b0501ac55096b)
Merged-In: I864ea0727c98d6a20c9c0b59aadcaf6720f7fe01
Change-Id: I864ea0727c98d6a20c9c0b59aadcaf6720f7fe01

143d1879

Dec 28, 2023

Merge cherrypicks of ['android-review.googlesource.com/2886406'] into 24Q1-release. · f9d1477e
Android Build Coastguard Worker authored 1 year ago
```
Change-Id: I39ce49c13c057c124cf5948a124a04c13a05ccec
```
f9d1477e

Copy the keys when re-pairing with a new RPA/IRK · f475f3c1

Hui Peng authored 1 year ago

With the refactor in aosp/2817298, the ble keys are dropped
in the consolidation process, which causes reconnection issues
as reported in b/315203403

This change makes sure the the BLE keys are correctly copied.

Bug: 315203403
Bug: 315487763
Test: m com.android.btservices
Test: manual | pair with BLE device with RPA1 (generated with IRK1) and repair it with RPA2 generated (by IRK2), re-pairing and reconenction work
Flag: EXEMPT, one-line bug-fix for a regression | critical fix that needs to be included in Q1-2024
(cherry picked from https://android-review.googlesource.com/q/commit:e9765fc813fae79bc113657ffed82880b7da3652)
Merged-In: Ia9c99681b3f9404dccd0f249ad0d6ab8848dc2f5
Change-Id: Ia9c99681b3f9404dccd0f249ad0d6ab8848dc2f5

f475f3c1

Dec 15, 2023

Merge cherrypicks of ['googleplex-android-review.googlesource.com/22948134',... · cde0b1f5

Android Build Coastguard Worker authored 1 year ago

Merge cherrypicks of ['googleplex-android-review.googlesource.com/22948134', 'googleplex-android-review.googlesource.com/25503067'] into udc-qpr1-release.

Change-Id: I9bc3fb9371a94f6da2490dc693e61ba5eae13442

cde0b1f5

Fix an OOB write bug in attp_build_read_by_type_value_cmd · 2d11abc3

Hui Peng authored 1 year ago

Bug: 297524203
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:140c41e3553bc59fe97e3f5ee96c64e2251971e2)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e9b40c3dfd81c3fa99b3f115135de7e2c356ece9)
Merged-In: I2a95bbcce9a16ac84dd714eb4561428711a9872e
Change-Id: I2a95bbcce9a16ac84dd714eb4561428711a9872e

2d11abc3

Fix an OOB bug in btif_to_bta_response and attp_build_value_cmd · 67241b75

Hui Peng authored 1 year ago

1. The size of `p_src->attr_value.value` is dependent on
   `p_src->attr_value.len`. While copying `p_src->attr_value.value`,
   to `p_dest->attr_value.value`, it always copies GATT_MAX_ATTR_LEN
   bytes, it may result in OOB read in `p_src->attr_value.value`;

2. As the `p_dest->attr_value.len` does not map the length of
   `p_dest->attr_value.value`, it may result in OOB read in
   attp_build_value_cmd;

Bug: 276898739
Test: manual
Tag: #security
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:59c9e84bd31d4935a875d588bf4d2cc5bfb07d59)
Merged-In: Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368
Change-Id: Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368

67241b75

Snap for 11220357 from 4b6c37a3 to 24Q1-release · 2fb073d9
Android Build Coastguard Worker authored 1 year ago
```
Change-Id: I172f2530f8a34cb624f77b523260581a889e18ec
```
2fb073d9

Dec 14, 2023

[Invisalign2] Make BTA_DmBleConfigLocalPrivacy synchronous am: am:... · 4b6c37a3

Hui Peng authored 1 year ago

[Invisalign2] Make BTA_DmBleConfigLocalPrivacy synchronous am: 21fa0c69 am: c04c69d5 am: e323c469

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2875614



Change-Id: I729daa8485aff7d45ce7bc602b71961b3faee86e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

4b6c37a3

[Invisalign2] Make BTA_DmBleConfigLocalPrivacy synchronous am: am: · e323c469

Hui Peng authored 1 year ago

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2875614

Change-Id: I3057ef224b279214bf149e22722e6f4e62e78c71
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

e323c469

[Invisalign2] Make BTA_DmBleConfigLocalPrivacy synchronous am: · c04c69d5

Hui Peng authored 1 year ago

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2875614

Change-Id: Ia2954ac277a59363bf1a2eae68ae4d731bec0b84
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

c04c69d5

[Invisalign2] Make BTA_DmBleConfigLocalPrivacy synchronous · 21fa0c69

Hui Peng authored 1 year ago

BTA_DmBleConfigLocalPrivacy is currently implemented
as asynchronous by posting a task to main thread.

With BTA_DmAddBleKey being made synchronous, this one
should be made synchronous, otherwise, IRKs of
bonded BLE devices won't be loaded properly if
BTA_DmAddBleKey is called before local privacy
is properly initialized, as reported in b/315736888.

Bug: 315736888
Bug: 311196228
Bug: 301661850

Test: atest net_test_btif_stack
Test: pair with a BLE device, restart Bluetooth and connec
Change-Id: Idc80e068767f2bb67450145fce3e0e3c8a2c45a5

21fa0c69