)]}' { "log": [ { "commit": "a0580dad5655e86314a0a777eb5f602c237a7e19", "tree": "115b304d76aace930818964b630d758d31b9643c", "parents": [ "4de4f60f1e78fa588bf3fdf744dc5cba389bb21e" ], "author": { "name": "Mohammed Sadiq", "email": "sadiq@sadiqpk.org", "time": "Tue Oct 20 09:26:17 2026 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 23 18:04:35 2026 -0400" }, "message": "obexd: Handle message read status change events\n\nobexd is advertised to support Extended Event Report 1.1. But it was\nnot handling \"ReadStatusChanged\" type which made those events being\nmismarked as MAP_ET_NEW_MESSAGE. This resulted in existing message to\nbe replaced by new message with only \"Status\" property set instead of\nupdating the \"Status\" of the existing message.\n" }, { "commit": "4de4f60f1e78fa588bf3fdf744dc5cba389bb21e", "tree": "a3e5291e7f2169c70ef7150db94d9deefc27c0e3", "parents": [ "1445a64e6b998a7cbccd85995d1d8dae659aa783" ], "author": { "name": "Aurélien Rivet", "email": "aurelienrivet@hotmail.fr", "time": "Thu Oct 22 18:01:26 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 23 18:04:34 2026 -0400" }, "message": "mesh: Fix Command Disallowed on random address change in generic IO\n\nsend_cancel_done() issues LE Set Random Address at the end of every\nburst of ADVs. The controller rejects that command with Command\nDisallowed (0x0c) while scanning is enabled, per Core Spec, Vol 4,\nPart E, Section 7.8.4, so the address never rotates as long as any\nscan is registered, such as a provisioner discovering unprovisioned\ndevices.\n\nPause scanning around the address change and resume it afterwards,\nmirroring the disable/re-enable sequence restart_scan() already uses.\nWhen no scan is registered there is nothing to pause, so the address\nchange is issued directly.\n\nConfirmed with btmon on a Raspberry Pi built-in controller: over a\n60 s capture, 12 rotations about 5 s apart, each one LE Set Scan\nEnable(disable) -\u003e LE Set Random Address -\u003e LE Set Scan\nEnable(enable), every command completing with Success and every\nrotation programming a distinct address. No Command Disallowed\nanywhere in the capture, where the address change previously failed\non every attempt. Scanning is suspended for 1.2 ms to 2.6 ms per\nrotation, which mesh retransmissions absorb.\n\nAssisted-by: Claude:claude-sonnet-5\nAssisted-by: Claude:claude-opus-5\n" }, { "commit": "1445a64e6b998a7cbccd85995d1d8dae659aa783", "tree": "ee8fda61838b0c70bd27b8279f17e803dd78621c", "parents": [ "48bb3b39698049594a283569d53f3fff0e168217" ], "author": { "name": "Tobias Wilken", "email": "tooangel@tooangel.de", "time": "Wed Oct 21 09:21:33 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 23 18:04:34 2026 -0400" }, "message": "mgmt-tester: Add Set Powered test for rfkill block\n\nBlock the controller through /dev/rfkill and check that Set Powered\nfails with RFKilled (0x12), the status bluetoothd handles for a\nblocked adapter. Without rfkill support in the kernel the test is not\nrun.\n\nKernels since Linux commit cf75ad8b41d2 (\"Bluetooth: hci_sync: Convert\nMGMT_SET_POWERED\") return Failed (0x03) instead; the fix is\n\"Bluetooth: MGMT: Return RFKILLED for Set Powered on a blocked\ncontroller\".\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "48bb3b39698049594a283569d53f3fff0e168217", "tree": "2324f7b7d81150c46970b419032dcc00676ccb68", "parents": [ "7bc9684dc9e45358661301da4a0ede433fdf0a30" ], "author": { "name": "Tobias Wilken", "email": "tooangel@tooangel.de", "time": "Wed Oct 21 09:21:32 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 23 18:04:34 2026 -0400" }, "message": "doc: Add CONFIG_RFKILL to the tester kernel config\n\nNeeded by mgmt-tester to block a controller through /dev/rfkill.\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "7bc9684dc9e45358661301da4a0ede433fdf0a30", "tree": "0925ece2b5a12296ae140a836e71e4784cddb3a7", "parents": [ "b79d4a88705f3c740620f1277cfd2b8d67d575f9" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sun Oct 18 06:39:11 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 19 11:10:33 2026 -0400" }, "message": "emulator: Avoid variable length array in send_cmd\n\nUse newa() for the iovec array of send_cmd(), as shared/gatt-client\ndoes, instead of a variable length array.\n\nThis fixes the following warning:\n\nemulator/btdev.c:479:29: warning: Variable length array is used.\n" }, { "commit": "b79d4a88705f3c740620f1277cfd2b8d67d575f9", "tree": "407ce37e5c2d04423671bf3e18ffba92143f057f", "parents": [ "a338533f913bf42b267aeba30f1344d85459c13c" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sun Oct 18 06:39:02 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 19 11:10:33 2026 -0400" }, "message": "a2dp: Remove duplicate check in transport_cb\n\ntransport_cb() checks setup-\u003estream twice in a row: commit\n0bed9886cff3 (\"a2dp: Fix crash on NULL stream in transport_cb\") and\ncommit d84171e6cd68 (\"a2dp: Fix crash on NULL stream in transport_cb\")\nadd the same check. Remove the second copy.\n" }, { "commit": "a338533f913bf42b267aeba30f1344d85459c13c", "tree": "ecbc2d25ab7e85ecfcce3fa285b5817da903952c", "parents": [ "6cdb936ebb6a3906062605883470d6b3a4e8c89e" ], "author": { "name": "Gianluca Altomani", "email": "altomanigianluca@gmail.com", "time": "Wed Sep 30 11:39:28 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 19 09:29:27 2026 -0400" }, "message": "shared/gatt-client: Fix double-queued service\n\ndiscovery_op_create() loads every service already in the client\ndatabase into pending_svcs, active or not, and discovery_found_service()\nthen queues an inactive service again when it finds it. A service left\ninactive by an earlier discovery that was cut short therefore ends up\nin the queue twice.\n\nIf that discovery fails too, discovery_op_complete() walks pending_svcs\nwith its removal callback already unregistered: the first entry removes\nand frees the service, and the second one dereferences it:\n\n gatt_db_service_get_active (src/shared/gatt-db.c)\n discovery_op_complete (src/shared/gatt-client.c)\n\nOnly queue an inactive service if it is not pending already.\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "6cdb936ebb6a3906062605883470d6b3a4e8c89e", "tree": "43c73cca7c76dc83c9844ca8cdea4d1f4512e75f", "parents": [ "5e348529cf4d1c5ca9be5c247243189fbffa89cf" ], "author": { "name": "Gianluca Altomani", "email": "altomanigianluca@gmail.com", "time": "Wed Sep 30 11:39:27 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 19 09:29:27 2026 -0400" }, "message": "shared/gatt-db: Always notify service removal\n\ngatt_db_service_destroy() only notified removal listeners about active\nservices. A gatt-client discovery keeps services that are not active\nyet in its pending_svcs queue, and it only drops them from that queue\nthrough this notification. When such a service is destroyed while the\ndiscovery is in flight, for example through gatt_db_clear_range() after\nthe link drops mid-discovery, the queue is left pointing at freed\nmemory, and discovery_op_complete() then dereferences it:\n\n gatt_db_service_get_active (src/shared/gatt-db.c)\n discovery_op_complete (src/shared/gatt-client.c)\n\nNotify removal whether or not the service was active. The other\nremoval listeners already ignore services they never saw added, since\nservices are only announced when they become active.\n\nIt is reproduced by connecting over LE, reading one characteristic and\ndisconnecting about once a second, so that the link repeatedly drops\nwhile bluetoothd is still discovering the peer: on 5.72 bluetoothd\ncrashed on the 15th connection in 4 runs out of 4.\n\nThe same change was found independently in\nhttps://github.com/ownback/airpods-bluez-fix.\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "5e348529cf4d1c5ca9be5c247243189fbffa89cf", "tree": "9cab6640f0649047226b93fa7ce9ed909c387134", "parents": [ "fa6ba55020dee3c3183041c854c347b4582448be" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Sun Oct 18 21:10:09 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 19 09:29:27 2026 -0400" }, "message": "monitor: Fix legacy SCAN_RSP PDU type names\n\nThe names of the two legacy scan response event types are swapped. A\nscan response keeps the properties of the advertisement it answers, so\n0x1b, which has the connectable bit set, is the response to ADV_IND and\n0x1a is the response to ADV_SCAN_IND, as listed in Core Specification\nVol 4, Part E, 7.7.65.13, Table 7.1.\n\nFixes: e29ef3b85116 (\"monitor: Add LE Extended Scan commands decoding\")\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "fa6ba55020dee3c3183041c854c347b4582448be", "tree": "4ea152c37bfd6b39fb03a72623f88b500f8b1cbc", "parents": [ "dd9d5ba1fa4f682b082b1275a8c38523d95a58fd" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 14 14:11:18 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 14 14:11:18 2026 -0400" }, "message": "mgmt-tester: Add LL Privacy host-resolved RPA scan checks\n\nControllers with LL Privacy resolve RPAs themselves, so peers with an\nIRK can be kept in the accept list and passive scanning shall use the\naccept list filter policy.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "dd9d5ba1fa4f682b082b1275a8c38523d95a58fd", "tree": "9e2ea15b88ce9011d8737bc423047659b008eb74", "parents": [ "0a48b5ef5e3d55e3ce0cf1a462ff49c3f465f329" ], "author": { "name": "Kyle Pepper", "email": "cochcoder@proton.me", "time": "Wed Oct 14 05:20:22 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 14 09:18:04 2026 -0400" }, "message": "mgmt-tester: Add host-resolved RPA scan checks\n\nCheck unfiltered passive scanning for IRK peers on controllers without\nLL Privacy, with auto-connect and background-report controls.\n\nAssisted-by: OpenCode:gpt-6.1-sol\n" }, { "commit": "0a48b5ef5e3d55e3ce0cf1a462ff49c3f465f329", "tree": "10ef535a02a2416055b06e8b5bb5da6c423affac", "parents": [ "8ebf7ffe7bc6ceb15d908073673f251ca3939df0" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 11:02:57 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 11:02:57 2026 -0400" }, "message": "test: functional: connect instead of pairing a bonded BAP device\n\nThe hosts are shared between tests, so a device bonded by an earlier one\nis still bonded when a later one pairs it, and pairing it again fails\nwith AlreadyExists. cmd_pair is meant to connect it instead, but it\nchecks Paired, which is not set until the services are resolved, so it\ncan still issue the pairing:\n\n FAILED test/functional/test_bap.py::test_bass_past_transport_acquire\n AssertionError: Failed to pair: org.bluez.Error.AlreadyExists\n\nCheck Bonded, which is what the pairing is rejected for, and connect the\ndevice instead when it is set.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "8ebf7ffe7bc6ceb15d908073673f251ca3939df0", "tree": "fdc4f2427aea0e085daad723fea9ad72c443ddf0", "parents": [ "02aa5ea219edb9d4c4bae700fd978de8da5d787a" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 10:01:32 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 10:01:32 2026 -0400" }, "message": "emulator: Add Minimum Supported Connection Interval\n\nFill the Minimum_Supported_Connection_Interval octet of the LE Read\nConnection Interval response, reporting 1 ms, the same lower bound as\nthe interval group already returned.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "02aa5ea219edb9d4c4bae700fd978de8da5d787a", "tree": "a866e4bd0ea265445cfa763e766249ae1f3cb426", "parents": [ "9dc7e40962f11d1d9a5568f8a7633a695288329c" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 10:01:32 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Oct 13 10:01:32 2026 -0400" }, "message": "monitor: Add Minimum Supported Connection Interval\n\nThe LE Read Connection Interval response carries a\nMinimum_Supported_Connection_Interval octet between the status and\nNum_Groups, in units of 125 us with a range of 0x03 to 0x3C. Add it to\nthe structure and decode it.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "9dc7e40962f11d1d9a5568f8a7633a695288329c", "tree": "e71d615ff7c3c3e9b022893a2f906eab4e8385a0", "parents": [ "49a70562f0bf4c1d19e26337a7c44c17c9283e8e" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:40:13 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:44:12 2026 -0400" }, "message": "bearer: Remove disconn_timer when freeing the bearer\n\nThe timer armed by Disconnect is only removed when it fires or when the\nbearer disconnects, so a device removed within DISCONNECT_TIMER seconds of\na Disconnect call leaves it to run bearer_disconnect_link() on the freed\nbearer.\n\nRemove it in bearer_free().\n\nFixes: 4e21ebcaa5d0 (\"bearer: Implement Connect/Disconnect methods\")\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "49a70562f0bf4c1d19e26337a7c44c17c9283e8e", "tree": "fb18d1cb3e71190dbde0612bd33691a4ddd61c78", "parents": [ "2942883d2738a70a96229e3088dd81ec8b5d02b0" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sat Oct 10 05:18:51 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:44:00 2026 -0400" }, "message": "mgmt-tester: Add simultaneous discovery stop tests\n\nWith HCI_QUIRK_SIMULTANEOUS_DISCOVERY, kernels without commit\n96d006ae6445 (\"Bluetooth: hci_event: fix simultaneous discovery stuck\nin FINDING\") stay in DISCOVERY_FINDING when the Inquiry Complete event\narrives after LE Set Scan Enable (disable) was sent but before its\nCommand Complete: no Discovering (disabled) event is sent and every\nlater Start Discovery fails with Busy.\n\nBoth tests set the quirk through debugfs and send the Inquiry Complete\nthemselves: one second into the discovery (Simultaneous Inquiry First,\nthe normal order) or from the LE Set Scan Enable (disable) command\nhook, before its Command Complete (Simultaneous Inquiry Late). The LE\nscan timeout itself is not shortened. One second after that command a\nnew Start Discovery probes the state; a test fails if no Discovering\n(disabled) event came before the probe or if the probe does not\nsucceed. Without the kernel fix the Late test fails. If the debugfs\nentry cannot be opened, the tests are reported as Not Run.\n" }, { "commit": "2942883d2738a70a96229e3088dd81ec8b5d02b0", "tree": "f6709e705e5ececad08e248946926f505f7d45bb", "parents": [ "f3344d20d9047a15c4c6becd94bef76b27ebdf5f" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sat Oct 10 05:18:50 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:43:44 2026 -0400" }, "message": "emulator/vhci: Add vhci_set_quirk_simultaneous_discovery\n\nSet or clear HCI_QUIRK_SIMULTANEOUS_DISCOVERY through the kernel\u0027s\nquirk_simultaneous_discovery debugfs entry, which only accepts writes\nwhile the controller is down.\n\nThis entry name is the longest so far: its path does not fit in the\n64 byte buffer of vhci_debugfs_write() from hci1000 on, so size the\nbuffer with PATH_MAX and use snprintf().\n" }, { "commit": "f3344d20d9047a15c4c6becd94bef76b27ebdf5f", "tree": "edb6f719bad72c1db5c723c798a1322aa25d2f9b", "parents": [ "da2406695f708edade0fa95849ad590f4b05ba5b" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sat Oct 10 05:18:49 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:43:27 2026 -0400" }, "message": "emulator: Add btdev_send_event\n\nAllow a tester to send an arbitrary event from the emulated controller,\nfor instance from a command hook, so that the order of events around a\ncommand can be chosen by the test.\n" }, { "commit": "da2406695f708edade0fa95849ad590f4b05ba5b", "tree": "04e5b46c2134789cea369cf896ca508bec8a2360", "parents": [ "bf98544491b2a09e1d88d5087725e58d61235ec5" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 13:33:41 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:43:14 2026 -0400" }, "message": "shared/rap: Track RAS CCC state per connection\n\nThe Real-time, On-demand, Ranging Data Ready and Ranging Data Overwritten\nCCC values were stored on the RAS service shared by all connections, while\nranging data is sent on the ATT channel of the connection that produced\nit. One central\u0027s subscription could therefore decide whether, and with\nwhich transport, another central was sent ranging data, and the Real-time\nvs On-demand exclusivity check rejected a central because of another\ncentral\u0027s configuration.\n\nStore the values on the bt_rap session of the writing connection instead\nand use them for the mode, transport and subscription checks.\n\nFixes: a9b39d71597d (\"src/shared: Add RAS packet format and notification support\")\nFixes: 2ac9fc0901c4 (\"shared/rap: Honor CCCD transport for RAS on-demand ranging data\")\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "bf98544491b2a09e1d88d5087725e58d61235ec5", "tree": "38051cdbcd48353a97f16feffa40adc5b1deda6c", "parents": [ "8da7e648a9fb7e510cc62ecce174bc7f0a3a66e8" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sat Oct 10 14:14:42 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:43:13 2026 -0400" }, "message": "unit: test-rap: disable optimization to speed up compilation\n\nCompilation of this file with optimization takes 4 minutes with ASAN.\nDisable optimization to reduce to 2 sec.\n\nautoconf puts global -O2 in CFLAGS that cannot be overridden eg. with\nunit_test_bap_CFLAGS. Use pragma instead.\n" }, { "commit": "8da7e648a9fb7e510cc62ecce174bc7f0a3a66e8", "tree": "1ed9b5a565f348b41c57e81c8187f0323c6e5285", "parents": [ "f088feb4f6dd725c16f3403e582fba45ed507df2" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Sat Oct 10 05:18:46 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:42:58 2026 -0400" }, "message": "emulator: Free hooks in btdev_destroy\n\nHooks added with btdev_add_hook() are only freed by btdev_del_hook(),\nso a hook still installed when the device is destroyed is leaked. Five\nmgmt-tester cases leave one installed: \"Add + Remove Device Nowait -\nSuccess\" and the four \"Adv. (non-)connectable \u0026 connected\" cases on the\nLE emulator; one l2cap-tester case does too. They pass, but with ASan\nthe tester exits with status 1 because LeakSanitizer reports, for\nmgmt-tester:\n\n Direct leak of 120 byte(s) in 5 object(s) allocated from:\n #0 in malloc\n #1 in btdev_add_hook emulator/btdev.c:8891\n\nFree the remaining hooks in btdev_destroy().\n\nFixes: 37199df506f4 (\"emulator: Add support for pre/post command/event hooks\")\n" }, { "commit": "f088feb4f6dd725c16f3403e582fba45ed507df2", "tree": "57cbd342b3ee9306647f76a8bba8a5de7e35158e", "parents": [ "1b52ab98e6c54d4794a78b6fc7a2f52071317ead" ], "author": { "name": "Ye He", "email": "ye.he@amlogic.com", "time": "Sat Oct 10 14:55:49 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:42:28 2026 -0400" }, "message": "device: Fix BR/EDR bearer when merging duplicate device\n\nA device first discovered over BR/EDR and later over LE with a private\naddress has two device objects until its IRK is distributed and they are\nmerged. device_merge_duplicate() copied dup-\u003ebredr into dev, so both\nobjects shared one bearer and whichever was freed second used a bearer\nalready destroyed by the first.\n\nGive dev its own BR/EDR bearer instead, unless it already has one, and\ninherit the paired and bonded state from dup. The connection state is not\ninherited since dup still owns the link and receives its disconnection.\n\nFixes: d9294d644930 (\"core: Add support for merging duplicate device object data\")\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "1b52ab98e6c54d4794a78b6fc7a2f52071317ead", "tree": "c82c0ab5e89bbf7f9050129672692c3f7219ba3e", "parents": [ "087ac3d6f198534702bf8cd8b89c83923bb18656" ], "author": { "name": "Ye He", "email": "ye.he@amlogic.com", "time": "Sat Oct 10 15:11:51 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 17:41:57 2026 -0400" }, "message": "bearer: Cancel disconn_timer upon btd_bearer_disconnected\n\nIf a fast reconnect occurs after a rapid disconnect,\nthe 2-seconds bearer-\u003edisconn_timer may still fire and\ntear down the newly established link.\n\nFix this by cancelling the disconn_timer inside\nbtd_bearer_disconnected().\n" }, { "commit": "087ac3d6f198534702bf8cd8b89c83923bb18656", "tree": "266608c85b8999dce5d82ed8c869d7f1cfd735f8", "parents": [ "7428ca2df9356363079db0f48412c20cbdb9471f" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 11:14:11 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 12 16:14:55 2026 -0400" }, "message": "test: functional: change the HoG connection rate from the HID device\n\nAs specified by the HIDS/HOGP SCI FIPD, the HID device initiates the\nConnection Rate Update procedure once the HID host writes the mode to\nthe HID Control Point, so load the connection subrate on the HID device\ninstead of the HID host.\n\nThis requires the kernel to issue the LE Connection Rate Request as\nperipheral, so the test is marked as expected to fail otherwise, the\nparameters being loaded but the connection rate never changed.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "7428ca2df9356363079db0f48412c20cbdb9471f", "tree": "a8d715a4509b7669b686c3bb7e543663a20d2a09", "parents": [ "ce448a8a7a3bf538c443235c9c7b38d4aea841cf" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 16:37:20 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 16:37:20 2026 -0400" }, "message": "device: Fix LE bearer Connect not replying\n\nIf the ATT socket of an outgoing LE connection connects before the MGMT\nDevice Connected event is processed, att_connect_cb sets the LE state as\nconnected, so device_add_connection bails out as already connected and\nbtd_bearer_connected is never called. Bearer.LE1.Connect is then left\nwithout a reply, the initiator flag is not set and Device1.Connected is\nnot emitted.\n\nFix it by calling device_add_connection from att_connect_cb when the LE\nstate is not yet connected.\n\nFixes: 4e21ebcaa5d0 (\"bearer: Implement Connect/Disconnect methods\")\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "ce448a8a7a3bf538c443235c9c7b38d4aea841cf", "tree": "fe20bd4e11a5bcbf25b0c6c5a52a4f99e2ea3d40", "parents": [ "926bbc5dfe29a19d579d29fd81d7c5a5952a3ecd" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Fri Oct 09 11:04:48 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 15:43:54 2026 -0400" }, "message": "test: functional: add bearer tests\n\nAdd tests where host0 connects to or pairs with host1 over LE or\nBR/EDR, and both hosts check the properties and the Disconnected\nsignal of the bearer interfaces of the device object they have for the\nother, including the LE Role of each side of the connection.\n\nSee doc/functional-bearer.rst for details.\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "926bbc5dfe29a19d579d29fd81d7c5a5952a3ecd", "tree": "9b997a5ce7da7e9d2612c0d27b1bb2721123dfc9", "parents": [ "2515706490c2d569885cd553a553de12cb2fc867" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Fri Oct 09 11:04:47 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 15:43:43 2026 -0400" }, "message": "doc: Add functional-bearer documentation\n\nDocument the bearer functional tests, where two hosts connect or pair\nover LE or BR/EDR and each checks the org.bluez.Bearer.LE1 and\norg.bluez.Bearer.BREDR1 properties of the device object it has for the\nother:\n\n- Connected and Role on both sides of an LE connection, and the\n Disconnected signal with its reason on both sides\n- Connectable for a connectable advertiser and for a broadcaster\n- Paired, Bonded and Connected after LE and BR/EDR pairing, Role being\n only reported for LE\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "2515706490c2d569885cd553a553de12cb2fc867", "tree": "1efeadc74af18f6b955d2c9623a7d3ba6591deed", "parents": [ "76890c8fd3255bd1b0d64e3c35abb38ef3d87b22" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Fri Oct 09 11:04:46 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 15:43:41 2026 -0400" }, "message": "client: Print LE.Role in info\n\nThis prints the Role property of the LE bearer with the likes of info\ncommand:\n\nbluetoothctl\u003e info \u003caddr\u003e\n...\n LE.Connected: yes\n LE.Connectable: yes\n LE.Role: central\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "76890c8fd3255bd1b0d64e3c35abb38ef3d87b22", "tree": "e64ae58f7c197bf20b95d44a071f42ae7387a46d", "parents": [ "c31e9091e646b61cfce3634baac03636f2760ac8" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Fri Oct 09 11:04:45 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 15:43:08 2026 -0400" }, "message": "bearer: Add Role property\n\nThis implements Role property for the LE bearer using the initiator\nflag of the Device Connected event, which the kernel sets when the\nadapter created the connection as central, and emits PropertiesChanged\nalong with Connected.\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "c31e9091e646b61cfce3634baac03636f2760ac8", "tree": "50628ee0e664a801899ca6b2fb6ce989d36690ae", "parents": [ "b111351fd617f57692aebc80db61e871d8ce52c9" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Fri Oct 09 11:04:44 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 15:42:33 2026 -0400" }, "message": "org.bluez.Bearer: Add Role property\n\nThis adds Role property to org.bluez.Bearer.LE1 which indicates whether\nthe remote device is the central or the peripheral of the current LE\nconnection, so applications can tell a central that connected to the\nadapter from a peripheral the adapter connected to.\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "b111351fd617f57692aebc80db61e871d8ce52c9", "tree": "0c916aefeb19b1ad3f8a17187c74b9c84b790a7f", "parents": [ "2cd5045f1ec455e5e61732d6139e9bac60a018c4" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:30 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "doc/qualification: Add RAP/RAS PTS qualification results\n\nRecord the PTS results for the Ranging Profile and the Ranging Service.\nBoth are split per case prefix, as the other qualification documents are:\nrap-pts.rst keeps the 19 RAP Requester and Responder cases, and the new\nras-pts.rst carries the 31 RAS Server cases.\n\nEvery case is listed on its own row rather than collapsed into a range, so\nthe file states which cases were actually run. RAS/SR/SPE/BI-02-C is\nlisted as not applicable: RAS.TS Table 5.1 selects it only when Abort\nOperation is unsupported (NOT RAS 3/4), and the IUT supports it, so\nRAS/SR/RCP/BV-03-C and RAS/SR/SPE/BI-05-C cover that path instead.\n\nras-pts.rst also records which transport the server must pick when a\nclient enables both notifications and indications, since the rule differs\nper characteristic and each variant has its own case.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "2cd5045f1ec455e5e61732d6139e9bac60a018c4", "tree": "57681d2ac5b4d36af5ef0a56b628be80f0577e23", "parents": [ "68ac6ad752f2e0578a9d093fb03b0803d9513204" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:29 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "doc: Document Channel Sounding ranging data mode control\n\nDocument the ChannelSounding1.SetRangingDataMode method and the\nbluetoothctl \"ranging-data-mode\" and \"advertise-rangeservice\" commands\nadded for RAP Requester and Responder control.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "68ac6ad752f2e0578a9d093fb03b0803d9513204", "tree": "7506a50b3f3ff5e0c31e205f2b604c5a77ed5d83", "parents": [ "cb837d2a8a4b3ce2d6291022b653beff9812ee42" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:28 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "client: Add Channel Sounding ranging data mode control\n\nAdd a \"ranging-data-mode\" command to the Channel Sounding submenu that\nselects how Ranging Data is received from a peer (disabled, real-time or\non-demand) and the CCCD transport (notify or indicate), invoking the\nChannelSounding1.SetRangingDataMode method on the device.\n\nAdd an advertising helper so the Responder can advertise the Ranging\nService UUID for discovery, together with a getter for the default\nLEAdvertisingManager proxy it needs.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "cb837d2a8a4b3ce2d6291022b653beff9812ee42", "tree": "ce8eb4a4f5d90fa40a2ef82fb5a48926f31948d0", "parents": [ "14ad98fba11c448643dab5d08e45dfda11dd4fca" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:27 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "profiles/ranging: Expose requester ranging data mode over D-Bus\n\nAdd a SetRangingDataMode method to the Channel Sounding interface so a\nclient can select how Ranging Data is received from the peer (Real-time\nor On-demand) and the CCCD transport to use, wiring through to\nbt_rap_set_ranging_data_mode().\n\nWhen a measurement stops, disable the Real-time Ranging Data\nsubscription so the peer receives the CCCD disable that the requester\nowns.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "14ad98fba11c448643dab5d08e45dfda11dd4fca", "tree": "339632f2f92a1a9353808d6490762b66e2bb634d", "parents": [ "1f23b80e5d02ef93116b68fef23112b4b783ffab" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:26 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "shared/rap: Add requester ranging data subscription API\n\nGive the RAS requester control over how Ranging Data is received from the\npeer. bt_rap_set_ranging_data_mode() picks Real-time, On-demand or neither,\ntogether with the CCC value to write on the peer, and\nbt_rap_disable_realtime_ranging() drops a Real-time subscription again.\nbt_rap_set_ondemand_ranging() selects the mode to use before GATT discovery\nhas completed.\n\nSetting a mode first unsubscribes whatever is currently subscribed, so the\nmodes do not stack, and fails when the RAS Features read has not completed\nor the peer does not advertise the mode being asked for.\n\nThe requested transport applies to the RAS Control Point, Ranging Data\nReady and Ranging Data Overwritten characteristics. On-demand Ranging Data\nitself stays on notifications whatever is asked for: it carries the\nsegmented transfer, and gating each segment on a confirmation would slow a\nlarge one down for no benefit on the receiving side. On-demand mode also\nreads Ranging Data Ready once subscribed, to pick up a counter published\nbefore the subscription existed.\n\nReal-time reception is guarded by the deadlines RAP 4.4.1.1 sets for the\nRequester: the CCCD is disabled again if no first segment arrives within\n5 seconds, or if more than 1 second passes between continuation segments,\nso a peer that stops sending does not leave the subscription open.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "1f23b80e5d02ef93116b68fef23112b4b783ffab", "tree": "e4628c3f5f24077a3426913d5bd59a05a1b9583d", "parents": [ "bf0ce0541f28ab42ce177bc613e621fd635ff23f" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:25 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "shared/rap: Add real-time ranging data delivery on the responder\n\nImplement the RAS responder side of Real-time Ranging Data. Completed\nranging-data segments are queued in a per-connection FIFO and delivered\non the Real-time Ranging Data characteristic, honoring the transport\nselected by the client\u0027s CCCD: notifications are paced with a fixed\ninter-segment interval, while indications are driven by ATT confirmations\nso the next segment is only sent once the previous one is acknowledged.\n\nThe pending real-time segment queue is cleared when a new CS procedure\nstarts, so stale segments from an aborted or superseded procedure are\nnever delivered to the peer.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "bf0ce0541f28ab42ce177bc613e621fd635ff23f", "tree": "8a0c4cf825c467ea785236c7d7cb9cffd283b466", "parents": [ "584baf5d5f78550a6d279000231b4cc031d9d241" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:24 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "shared/rap: Shorten the requester Control Point response timeout\n\nRAP 4.5.4.1 gives the Requester two deadlines once it has written Get\nRanging Data, both enforced by sending Abort Operation: no On-demand\nRanging Data at all within 5 seconds of the command\n(RAP/REQ/ORD/BI-01-C), and no following segment within 1 second of the\nprevious one (RAP/REQ/ORD/BI-02-C).\n\nThe watchdog the requester arms while waiting for a Control Point\nresponse covered the first of those, but ran for 10 seconds, so it\nwould abort well after the specified deadline. Arm it for 5 seconds\ninstead. The per-segment deadline is handled separately by\nras_cp_arm_segment_timeout(), which uses RAS_SEGMENT_TIMEOUT.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "584baf5d5f78550a6d279000231b4cc031d9d241", "tree": "0de572d47f64f1acd7ceda370009188d3e655180", "parents": [ "2ac9fc0901c4be8ecf9268d7cb7cf66d1557b8d0" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:22 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:58 2026 -0400" }, "message": "shared/rap: Add RAS Control Point Abort Operation\n\nImplement the Abort_Operation procedure (Op Code 0x03) so a client can\ncancel an On-demand Ranging Data transfer that is already in progress,\nand advertise it through bit 2 of the RAS Features characteristic.\n\nAbort clears the sending state, removes the pending segment timer and\ncancels any in-flight indication, so a late confirmation cannot drive a\nsegment of a subsequent transfer. Since the transfer keeps at most one\nsegment outstanding, this stops it instead of letting a queued backlog\ndrain out.\nThe Control Point busy check lets Abort through while every other Op Code\nis answered with Server Busy, so an abort is accepted mid-transfer.\n\nOn the requester side, an Abort is written when a Get_Ranging_Data\nrequest times out and the peer advertises Abort support, so the responder\ndoes not keep sending data for a request the requester gave up on.\n\nUpdate the RAS Features value expected by unit/test-rap accordingly.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "2ac9fc0901c4be8ecf9268d7cb7cf66d1557b8d0", "tree": "23a92d90ad0127f19eee83ffc04e8b7962c90ead", "parents": [ "8199d710021e7f2854ae53f45e851950f8b1fec6" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:21 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:57 2026 -0400" }, "message": "shared/rap: Honor CCCD transport for RAS on-demand ranging data\n\nComplete the RAS responder handling of On-demand Ranging Data so the\ntransport used for each notified characteristic follows the peer\u0027s CCCD\nsubscription. The On-demand Ranging Data, RAS Control Point, Ranging\nData Ready and Ranging Data Overwritten characteristics are delivered\nas notifications or indications according to how the client configured\ntheir CCCDs. Ready and Overwritten gain a CCC write callback so their\nsubscribed transport is tracked, and a Ranging Counter each so a read\nreturns the value last notified.\n\nWhen a client enables both transports (0x0003) the spec does not pick the\nsame one everywhere, so the two rules are kept in separate helpers:\nRanging Data Ready and Ranging Data Overwritten are indicated per RAS\n3.4.2 and 3.5.2, while On-demand and Real-time Ranging Data are notified\nper RAS 3.2.2 and 3.2.3.1. The RAS Control Point is indicate-only.\n\nRanging data is segmented across ATT PDUs, and it was queued a whole\ntransfer at a time. Notifications land on the att write queue, which\npick_next_send_op() drains ahead of the request queue and with no flow\ncontrol of its own, so doing that starves incoming ATT operations until the\nlast segment has been written: a Control Point write arriving mid-transfer\nis only answered once the transfer ends.\n\nSend one segment at a time instead. Indications go out with bt_att_send()\nand the next segment is queued from the confirmation callback;\nnotifications have no confirmation to gate on, so the next one is queued\nfrom a short timeout. Either way a single segment is outstanding, so an\nAbort Operation stops the transfer rather than letting a queued one drain\nout.\n\nThe notification delay cannot be zero: a zero timeout yields the event loop\nwithout waiting, so a Control Point write is only seen once it has already\narrived, and a short transfer can finish before an Abort crosses the air\ninterface. Against RAS/SR/SPE/BI-05-C, which writes an invalid Abort\nOperation mid-transfer, 0 ms fails and 5 ms passes, so use that.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "8199d710021e7f2854ae53f45e851950f8b1fec6", "tree": "5cb190d4f3f1946c369781c6aeb5a4e0a08bf8d1", "parents": [ "531aa5a00f0504a194a4e66a0d1a092d8194b928" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:20 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:57 2026 -0400" }, "message": "shared/gatt-db: Add gatt_db_attribute_indicate()\n\ngatt_db_attribute_notify() leaves the choice between a notification and an\nindication to the CCC value the client wrote, preferring notifications\nwhenever the client enabled them. A server cannot therefore honour a\ncharacteristic that has to be indicated: the Ranging Service requires\nRanging Data Ready and Ranging Data Overwritten to be indicated even when\nthe client subscribed to both transports (RAS 3.4.2, 3.5.2).\n\nAdd gatt_db_attribute_indicate() next to it. The two share a helper and\ndiffer only in the opcode handed to the notify callback, so the CCC lookup\nstays in one place, and a callback that does not care keeps working\nunchanged.\n\ngatt-database honours the request by skipping the notification branch and\nsending an indication instead, provided the client enabled indications.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "531aa5a00f0504a194a4e66a0d1a092d8194b928", "tree": "f653e91726d7758718f2961207d449b5c5d1bfb6", "parents": [ "52fdca35b8e7af87718dd659bf4c68d6afeb2433" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:18 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:41:57 2026 -0400" }, "message": "shared/gatt-db: Pass the ATT opcode to the notify callback\n\ngatt_db_read_t and gatt_db_write_t both tell the callback which ATT\noperation it is serving through an opcode argument. gatt_db_notify_t does\nnot, so a notify callback can only assume a notification.\n\nPass the opcode the same way, set to BT_ATT_OP_HANDLE_NFY, which is what\ngatt_db_attribute_notify() has always meant. No caller behaviour changes\nyet; it gives the callback somewhere to read the transport from once there\nis more than one. The unit test callbacks are updated in the same change\nso the tree keeps building.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "52fdca35b8e7af87718dd659bf4c68d6afeb2433", "tree": "466af5b8f449b91c7788540e311c5c55ce55c99e", "parents": [ "a57c6d52e7cc87e30768d09aadff4c7b3a736938" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Fri Oct 09 17:25:17 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:19:33 2026 -0400" }, "message": "shared/gatt-client: Allow registering notify with explicit CCC value\n\nbt_gatt_client_register_notify() picks the CCC value to write based on\nthe characteristic properties, preferring notifications over indications\nwhen both are supported. A client that specifically needs one of the two\n- for example the Ranging Service, which distinguishes notification and\nindication transports - has no way to request it.\n\nAdd bt_gatt_client_register_notify_with_ccc() which takes the desired\nCCC value (0x0001 for notifications, 0x0002 for indications) and writes\nit verbatim. register_notify() gains a ccc_value argument and rejects a\nvalue the characteristic does not support. The existing entry point\nkeeps its behaviour by passing 0, which restores the property-based\nselection.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "a57c6d52e7cc87e30768d09aadff4c7b3a736938", "tree": "a85a6fb19c3382e8bcdc03eee245dd50674d59b1", "parents": [ "866b0b8b162f52fa8a5452d2017093806ba1b570" ], "author": { "name": "Gabriel Berfield", "email": "gabriel.berfield@gmail.com", "time": "Thu Oct 08 11:13:52 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 09 10:17:43 2026 -0400" }, "message": "client: Handle system bus connection failures\n\nReport the system-bus connection error and exit before attaching the\nobject manager when the connection is unavailable. This avoids a libdbus\nassertion abort in restricted environments and releases the initialized\nshell state on failure.\n\nFixes: 8a05f2b1ac91 (\"client: Add initial parts for the command line client\")\nLink: https://github.com/bluez/bluez/issues/2446\nAssisted-by: Codex:GPT-6\n" }, { "commit": "866b0b8b162f52fa8a5452d2017093806ba1b570", "tree": "aae102085c028d811a34880b5ab8ba5e964d3f7c", "parents": [ "6f5eeb402d3b1d448acd4e448a682409cc1a9a2a" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 08 11:16:04 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 08 11:16:04 2026 -0400" }, "message": "unit/test-mgmt: Convert to use tester\n\nTeardown is deferred to an idle callback so the mgmt instance is not\nfreed from within its own callbacks, and the unregister test checks\nthat ran after the main loop returned now run from that teardown.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "6f5eeb402d3b1d448acd4e448a682409cc1a9a2a", "tree": "5e8e736426dc62d402b47de7c58f7cf702e45cbe", "parents": [ "ae23df052290d4add0981091515a33b229e223cc" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Thu Oct 08 05:41:02 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 08 10:57:11 2026 -0400" }, "message": "unit/test-mgmt: Test unregistering from callbacks\n\nAdd /mgmt/unregister/3 to /5, where a notification callback\nunregisters its own entry, the next entry, or another entry followed\nby mgmt_unregister_all(). The unregistered entry must not be notified\nagain, its destroy callback must not run inside the notification and\nmust have run once by the next idle callback, and unregistering it\nagain must fail.\n\nAdd /mgmt/unregister/6, which unregisters outside a notification: the\nentry is destroyed at once and unregistering it again fails.\n\nWithout the previous patch, /4 faults under ASan (heap-use-after-free\nin queue_foreach()), /3 never destroys the entry, and /5 gets true for\nan entry already marked removed.\n" }, { "commit": "ae23df052290d4add0981091515a33b229e223cc", "tree": "8abcee22d107f35caaacc6dd31187e3e618562e3", "parents": [ "1baa0a2aef3b4f931c59885f15788e10bc76b2c9" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Thu Oct 08 05:41:01 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 08 10:57:11 2026 -0400" }, "message": "shared/mgmt: Fix notify leak in mgmt_unregister()\n\nmgmt_unregister() called from a notification callback takes the entry\noff notify_list and marks it removed instead of freeing it.\nprocess_notify() frees the removed entries still on notify_list once\nthe walk is done, so this one is never freed and its destroy callback\nnever runs.\n\nIf the callback unregisters the next entry rather than its own, this\nis also a use-after-free: queue_foreach() has already saved that\nentry\u0027s queue node, and queue_remove_if() frees it. That is the crash\nfixed for mgmt_unregister_index() by commit 872729a91632\n(\"shared/mgmt: Fix crash when removing index\"), still present in\nmgmt_unregister().\n\nLeave the entry on the list while notifying, as mgmt_unregister_index()\nand mgmt_unregister_all() do, and let process_notify() free it.\nUnregistering an entry that is already marked removed now returns\nfalse, since it is no longer registered; for an entry marked by\nmgmt_unregister_index() or mgmt_unregister_all(), mgmt_unregister()\nused to return true, take it off the list and leak it. No caller\nchecks the return value.\n\nmgmt-tester, mesh-tester and userchan-tester unregister from event\ncallbacks, and under ASan each reports these entries as leaked, for\nexample userchan-tester:\n\n Direct leak of 80 byte(s) in 2 object(s) allocated from:\n #0 in malloc\n #1 in util_malloc src/shared/util.c:46\n #2 in mgmt_register src/shared/mgmt.c:974\n #3 in test_open_success tools/userchan-tester.c:275\n\nFixes: 872729a91632 (\"shared/mgmt: Fix crash when removing index\")\n" }, { "commit": "1baa0a2aef3b4f931c59885f15788e10bc76b2c9", "tree": "7b293caf16e803a217e30d41a83c77545aaddcf9", "parents": [ "ab5df7ba30190636b85f23c5a0798e7707748047" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Thu Oct 08 04:27:20 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 08 10:56:23 2026 -0400" }, "message": "sdp: Prevent integer underflow in string attribute length calculation\n\nIn lib/bluetooth/sdp.c, attribute string length calculations subtract\nsizeof(uint8_t) from d-\u003eunitSize (e.g. d-\u003eunitSize - sizeof(uint8_t)).\nWhen d-\u003eunitSize is 0 or less than sizeof(uint8_t), this subtraction\nunderflows in 32-bit integer arithmetic to a negative/huge length value,\npassing invalid sizes to memory allocation and length extraction\nfunctions.\n\nAdd explicit lower-bound guards checking d-\u003eunitSize \u003e (int)sizeof(uint8_t)\nto ensure that when d-\u003eunitSize \u003c\u003d sizeof(uint8_t), the calculated string\nlength is safely set to 0.\n\nAssisted-by: Antigravity\n" }, { "commit": "ab5df7ba30190636b85f23c5a0798e7707748047", "tree": "5c4f65628a5662f5a2e27df74ea48fddeba0f315", "parents": [ "79aedd33f8faed29c9e53d6bd245f3c2a552d5d4" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 15:39:42 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 15:39:42 2026 -0400" }, "message": "test: Cover A2DP disconnection during SetConfiguration\n\nAdd test_a2dp_disconnect_during_setconf, where the source disconnects\nwhile the sink endpoint has not replied to SetConfiguration yet, and\nthe late reply, either accepting or rejecting, must be ignored and the\nstream configured again on reconnection.\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "79aedd33f8faed29c9e53d6bd245f3c2a552d5d4", "tree": "4196473a7b4e366af13653ee83c2c81d50ddd85c", "parents": [ "ef54133c69e9e2c50ebae1212ee400ed8a6dc34c" ], "author": { "name": "Eduardo Alves", "email": "eduardoalves8006@gmail.com", "time": "Thu Oct 01 10:34:36 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 15:39:42 2026 -0400" }, "message": "a2dp: Fix crash on NULL session in auto_config\n\nIf the AVDTP channel is disconnected while bluetoothd is still waiting\nfor the MediaEndpoint1 to reply to SetConfiguration, channel_free()\nsets setup-\u003esession to NULL but the setup stays alive since the pending\nendpoint request holds a reference to it. Once the endpoint replies, or\nthe call times out and the request is canceled, endpoint_setconf_cb()\ncalls auto_config() which passes the NULL session to avdtp_get_device()\nand then dereferences the resulting NULL device:\n\n bluetoothd[820]: profiles/audio/media.c:endpoint_reply() Endpoint\n replied with an error: org.freedesktop.DBus.Error.NoReply\n kernel: bluetoothd[820]: segfault at 1a0 ip 00005633dd741323\n sp 00007ffe51923650 error 4 in bluetoothd\n\n #0 auto_config (data\u003d0x56340361a120) at profiles/audio/a2dp.c:723\n #1 endpoint_setconf_cb (setup\u003d...) at profiles/audio/a2dp.c:768\n #2 media_endpoint_cancel (request\u003d...) at profiles/audio/media.c:208\n #3 media_endpoint_cancel_all () at profiles/audio/media.c:216\n #4 clear_endpoint () at profiles/audio/media.c:379\n #5 endpoint_reply (user_data\u003d...) at profiles/audio/media.c:407\n\n (gdb) p *setup\n $1 \u003d {chan \u003d 0x0, session \u003d 0x0, ...,\n setconf_cb \u003d 0x5633dd74c780 \u003csetconf_cb\u003e, ..., ref \u003d 2}\n\nCommit 14750a2e48f4 (\"audio/a2dp: Fix Access session device only when\nits valid\") fixed the same crash, but commit 77932f2dac1a\n(\"profiles/audio: add nullity checks\") moved avdtp_get_device() back\nahead of the checks. Just reordering is not enough though: the\na2dp_stream is still on sep-\u003estreams, so the aborted check passes and\nsetconf_cb() would then be called with a NULL session as well.\n\nFix it by making finalize_all() abort the pending Set Configuration\nwhile the session is still valid: clearing the endpoint configuration\nsends ClearConfiguration, removes the MediaTransport created for the\nrequest and cancels the request, so auto_config() rejects the\nconfiguration and frees the pending avdtp_stream and a2dp_stream, both\npreviously leaked together with the session reference held by the\nlatter. If no request is pending, the configuration is rejected\ndirectly. auto_config() bails out when setup-\u003esession is NULL, as it\nmay still run from idle, and setconf_cb is cleared once called so it\ncannot be called twice.\n\nRemoving a transport now cancels the endpoint requests pending for it,\nso a late reply is ignored instead of leaving the transport registered,\nwhich made the next connection fail with \"Resource temporarily\nunavailable\".\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "ef54133c69e9e2c50ebae1212ee400ed8a6dc34c", "tree": "8b0497faad817221bf9361bc21e37dae26d404fd", "parents": [ "d84171e6cd68a5ab95d0f3a384279c36bd108a13" ], "author": { "name": "Eduardo Alves", "email": "eduardoalves8006@gmail.com", "time": "Thu Oct 01 10:34:35 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:53:27 2026 -0400" }, "message": "a2dp: Fix UAF after rejected SetConfiguration\n\nWhen the MediaEndpoint1 rejects SetConfiguration, auto_config() calls\nsetconf_cb() with an error and avdtp frees the avdtp_stream, but the\na2dp_stream wrapping it is left on sep-\u003estreams with a dangling stream\npointer. The next stream configured on the same session finds it in\na2dp_config() and reads the freed avdtp_stream:\n\n ERROR: AddressSanitizer: heap-use-after-free\n READ of size 4\n #0 avdtp_stream_get_state profiles/audio/avdtp.c:3952\n #1 a2dp_config profiles/audio/a2dp.c:3282\n #2 select_complete profiles/audio/source.c:200\n #3 finalize_select profiles/audio/a2dp.c:486\n freed by thread T0 here:\n #1 stream_free profiles/audio/avdtp.c:747\n #2 setconf_cb profiles/audio/avdtp.c:1504\n #3 auto_config profiles/audio/a2dp.c:752\n #4 endpoint_setconf_cb profiles/audio/a2dp.c:768\n\nFix it by destroying the a2dp_stream when the configuration is\nrejected, which also drops the session reference it holds.\n\nThis can be reproduced with test-functional using two VMs over btvirt,\nwhere the A2DP Sink endpoint replies to SetConfiguration with an error\nand the sink then connects to the source on the same session.\n\nAssisted-by: Claude:claude-opus-5-5\n" }, { "commit": "d84171e6cd68a5ab95d0f3a384279c36bd108a13", "tree": "7007ed0cc3592a70ad0f2ced6fe99737d4a7e440", "parents": [ "73d7f86a117a7ec5b32f82e50bf4decdc2cef5a5" ], "author": { "name": "Iaroslav Voitovych", "email": "yaroslav.voytovych@gmail.com", "time": "Mon Sep 21 22:47:11 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:47:18 2026 -0400" }, "message": "a2dp: Fix crash on NULL stream in transport_cb\n\ntransport_cb() runs from bt_io_accept() and begins by confirming that\nthe a2dp_setup it was handed still exists:\n\n if (!g_slist_find(setups, setup)) {\n warn(\"bt_io_accept: setup %p no longer valid\", setup);\n ...\n }\n\nThat establishes the lifetime of the setup, not of the stream it\npoints at. Several paths in a2dp.c clear setup-\u003estream while leaving\nthe setup itself on the list, so by the time the accept completes the\nsetup can be valid and its stream NULL. confirm_cb() already refuses\nto start the accept when setup-\u003estream is NULL; nothing re-checks it\nwhen the accept completes, and it is then passed on unchecked:\n\n if (!avdtp_stream_set_transport(setup-\u003estream,\n g_io_channel_unix_get_fd(io),\n imtu, omtu))\n\nand avdtp_stream_set_transport() dereferences it immediately:\n\n gboolean avdtp_stream_set_transport(struct avdtp_stream *stream, ...)\n {\n GIOChannel *io \u003d g_io_channel_unix_new(fd);\n\n if (stream !\u003d stream-\u003esession-\u003epending_open) {\n\nObserved as a crash on a QCA9377 (13d3:3503) whose controller stops\nanswering HCI during audio use. From the retained core, %r13 held NULL\nand the faulting instruction was the first field load off it:\n\n bluetoothd[398112]: segfault at 10 ip 0000635d944b47e5 \\\n sp 00007ffefcba28d0 error 4 in bluetoothd[367e5,635d944a3000+f3000]\n\n r13 0x0\n \u003d\u003e 0x635d944b47e5: mov 0x10(%r13),%rdi\n\nWith the check in place and the daemon logging before it bails, the\nguard fired four times in 19 days of ordinary use on the same machine\n(once on 2026-08-26, three times on 2026-09-02, across two daemon\nlifetimes and three distinct setup pointers). Each of those is an\naccept that completed after the stream had been cleared; unpatched,\neach is the dereference above.\n\nCheck the stream immediately before it is used, so every existing path\nkeeps its current behaviour up to the point that was previously\nunsafe. In particular a bt_io_accept() error or a bt_io_get() failure\nstill reports the real I/O error rather than this secondary lifecycle\ncondition.\n\ncommit 125a2e237e7c (\"a2dp: Fix possible crash when accepting stream\ntransport\") previously hardened this same asynchronous accept window\nagainst the whole setup disappearing while the accept was pending.\nThis covers the remaining case where the setup survives and its stream\ndoes not.\n\ncommit 90a600895d80 (\"avdtp: Handle case where remote send L2CAP\nconnect ahead of Open\") also changed avdtp_stream_set_transport()\nitself, to handle a transport arriving before Open. The function still\ndereferences stream before reaching that handling, so it does not\ncover a NULL argument from transport_cb().\n" }, { "commit": "73d7f86a117a7ec5b32f82e50bf4decdc2cef5a5", "tree": "f808f09f6dfeead1b9969ee9551c3ba02be724c5", "parents": [ "11f99edc26c78b2bedfbb44f91008cbcea5a1a53" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Mon Oct 05 09:21:17 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:27 2026 -0400" }, "message": "emulator: Fix report type after a scan response\n\next_adv_broadcast stored the scan response type in report_type, which\nis also used for the advertising report to the next scanner, so every\nactive scanner after the first got the advertisement reported as a scan\nresponse.\n\nFixes: 32339501a125 (\"emulator: Add 5.0 feature support\")\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "11f99edc26c78b2bedfbb44f91008cbcea5a1a53", "tree": "6ce9c7ba6b2e6f75839e41c43e4c6ff2f4c8c04a", "parents": [ "28cfa93135d4e77114f4e3c93954eeb37e1d130c" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Mon Oct 05 09:21:16 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:27 2026 -0400" }, "message": "emulator: Fix extended scan response Event_Type\n\nThe scan response to non-legacy scannable advertising was reported with\nEvent_Type 0x0000, since the scan response bit was masked instead of\nset, so hosts saw it as a separate non-connectable advertisement.\n\nFixes: 32339501a125 (\"emulator: Add 5.0 feature support\")\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "28cfa93135d4e77114f4e3c93954eeb37e1d130c", "tree": "462455462c0c5c87d7a484055653c3a6a563f8d0", "parents": [ "4b44e0726c6fb81bc972087edecc136c4038d3a4" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Mon Oct 05 09:21:15 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:27 2026 -0400" }, "message": "emulator: Remove unused le_ext_adv_type\n\nNothing has read le_ext_adv_type since advertising sets got their own\nstruct le_ext_adv in commit 5145b1ea2e95 (\"emulator/btdev: Add support\nmultiple instance of extended advertising\"). Remove it along with\next_legacy_adv_type, rather than fix that function\u0027s mapping of low\nduty cycle directed advertising (0x04) to ADV_SCAN_IND.\n\nAssisted-by: Claude:claude-opus-5.5\n" }, { "commit": "4b44e0726c6fb81bc972087edecc136c4038d3a4", "tree": "649792b5362adad763a02f4823687b69ce0010ad", "parents": [ "47f783ff5ba40135feb2fb1a68dcd1a8f457df04" ], "author": { "name": "Derek Tern", "email": "1263187-dt@users.noreply.gitlab.freedesktop.org", "time": "Tue Oct 06 11:01:38 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:27 2026 -0400" }, "message": "test: Cover BAP transport release and reacquire\n\nAcquire both unicast transports, close their sockets and release them\nthrough the same D-Bus owner. Require an empty Release reply so a late\nready callback cannot pass unnoticed by returning an Acquire payload.\n\nWait for both Acquire replies before Release, and for both Release\nreplies before the next Acquire. Only requests on different transport\npaths are concurrent; no path has successive operations queued without\nwaiting for its preceding reply.\n\nRepeat three times with immediate, 100 ms and one-second reacquisition.\nCheck Acquire reply types and active transport states. Close returned\nFDs even when a reply is malformed.\n\nAssisted-by: Codex:GPT-6\n" }, { "commit": "47f783ff5ba40135feb2fb1a68dcd1a8f457df04", "tree": "802be31dd9d40ce7dc3333a8c88a2b71205cbd63", "parents": [ "d852faf0b1d1a9a5b2c0e2bb0b8310a21f1cff58" ], "author": { "name": "Derek Tern", "email": "1263187-dt@users.noreply.gitlab.freedesktop.org", "time": "Tue Oct 06 11:00:53 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:27 2026 -0400" }, "message": "bap: Recreate stream IO after an early Enable\n\nWhen reacquiring a transport, the stream can reach Enabling before its\nprevious CIS finishes disconnecting. Once teardown completes, IO\nrecreation accepts only QoS, while CIS enabling requires existing IO.\nThe pending Acquire consequently stalls.\n\nAllow deferred IO recreation in Enabling too. Keep the existing CIG-busy\nchecks and recreate all IO before enabling CISes.\n\nFixes: 7feff47a9fbe (\"bap: delay QoS \u0026 IO creation if CIG is busy or setups configuring\")\nAssisted-by: Codex:GPT-6\n" }, { "commit": "d852faf0b1d1a9a5b2c0e2bb0b8310a21f1cff58", "tree": "8c837297c06783a84adf7293cbaa0d056224a177", "parents": [ "f8f352d133faadefbf1c6c476c0d9272f64d8c3f" ], "author": { "name": "Derek Tern", "email": "1263187-dt@users.noreply.gitlab.freedesktop.org", "time": "Tue Oct 06 11:00:24 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Oct 07 14:17:26 2026 -0400" }, "message": "transport: Preserve Release on late BAP ready\n\nA late stream-ready event can reach bap_resume_complete() after Release\nhas queued Disable. It then replies to Release with an Acquire payload\nand drops the Disable request ID. Client disconnection can subsequently\nfree the owner while the Disable callback still refers to it.\n\nOnly complete pending Acquire/TryAcquire requests from this path. Leave\nRelease and its request ID for the Disable callback or cancellation.\n\nFixes: 466fce0209a3 (\"transport: handle BAP Enabling state correctly when resuming\")\nAssisted-by: Codex:GPT-6\n" }, { "commit": "f8f352d133faadefbf1c6c476c0d9272f64d8c3f", "tree": "7ef221ff15a4aca6d35f4a04b7c6c3db59f23725", "parents": [ "9b18ccef2c09c3c33a81a3e7e4a8284e6f3553fb" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 11:15:05 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:22:09 2026 -0400" }, "message": "mgmt-tester: Add Global Advertising tests for extended advertising\n\nWith extended advertising, instances are advertised concurrently with\nGlobal Advertising, so update \"Set Adv off override\" to expect only\nthe set of instance 0 to be disabled, and add tests checking that\nadding an instance enables it and that removing the last instance does\nnot disable Global Advertising.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "9b18ccef2c09c3c33a81a3e7e4a8284e6f3553fb", "tree": "13d185d06a83f26f170ae13c47c43857fe37ce25", "parents": [ "7edaa61403390fe1cf2f1fb6d45fdd90fe6e93b3" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 11:15:04 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:22:09 2026 -0400" }, "message": "doc/mgmt: Document Advertising setting as Global Advertising\n\nThe Advertising setting always uses instance 0, and with extended\nadvertising it has a dedicated advertising set, so only instances\nsharing that set are overridden by it; the others are advertised\nconcurrently and removing instances never disables it.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "7edaa61403390fe1cf2f1fb6d45fdd90fe6e93b3", "tree": "6e6382d5c3e6d468aa0f1b1a0f64c9ce3b2e0702", "parents": [ "003db642000844d2ecd27ec5c81c7355561fbec2" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:36 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:44 2026 -0400" }, "message": "audio/hfp-hf: Add codecs support\n" }, { "commit": "003db642000844d2ecd27ec5c81c7355561fbec2", "tree": "a95c94b1b6215c068da85b7574d4b111c70e046c", "parents": [ "45384edcd1c70b0883ce1927c462837972c77377" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:35 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:42 2026 -0400" }, "message": "shared/hfp: Add codecs support\n\nThis send the AT+BAC command with the supported codec list during\nSLC connection.\n\nOn reception of +BCS event to select a codec to use it replies with\nthe same codec if it is available, or re-send the AT+BAC to re-trigger\ncodec selection.\n" }, { "commit": "45384edcd1c70b0883ce1927c462837972c77377", "tree": "d9427e46f7ee27b5303b64b68e0748b8aa9c6fe5", "parents": [ "2a4adbb2a7179573b6875f219c9fae5d1ae7a35e" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:34 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:42 2026 -0400" }, "message": "client/telephony: Add multi calls support\n\nThis adds menu entries for the SwapCalls, ReleaseAndAnswer,\nReleaseAndSwap and HoldAndAnswer methods from org.bluez.Telephony1.\n" }, { "commit": "2a4adbb2a7179573b6875f219c9fae5d1ae7a35e", "tree": "7bc9335f9419101d9e70a79e0bd317290d6a0f68", "parents": [ "a9b8a5ef6ec791082ae41c7bd4c1bbc0bc7336ac" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:33 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:42 2026 -0400" }, "message": "audio/hfp-hf: Add multi calls support\n\nThis implements the SwapCalls, ReleaseAndAnswer, ReleaseAndSwap and\nHoldAndAnswer methods from org.bluez.Telephony1.\n" }, { "commit": "a9b8a5ef6ec791082ae41c7bd4c1bbc0bc7336ac", "tree": "37b7fa114f025f7d9185c583ab996f06721c45c7", "parents": [ "e9046f3fb78d8833409708a2d569e9e7a84b53ed" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:32 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:42 2026 -0400" }, "message": "client/telephony: Add Send Tones menu entry\n" }, { "commit": "e9046f3fb78d8833409708a2d569e9e7a84b53ed", "tree": "a3f1c7802bcf70416d2c75e2bc5cedfb6bd2814c", "parents": [ "67883db59611b38df858313e8e6e308666bd3b0c" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:31 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:41 2026 -0400" }, "message": "audio/hfp-hf: Add Send Tones support\n" }, { "commit": "67883db59611b38df858313e8e6e308666bd3b0c", "tree": "33e37cada245eb7aa2f299a16a755fd88f53e132", "parents": [ "0a8dfeff2f79670d80ce3def3b8bc9a3b8096ce3" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:30 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:40 2026 -0400" }, "message": "shared/hfp: Add send tones support\n" }, { "commit": "0a8dfeff2f79670d80ce3def3b8bc9a3b8096ce3", "tree": "58baad9f4b8749775d39063e1a7c6426fcde99f8", "parents": [ "f7fd0acef7ee1955dde4640fc5f47cb266f352f9" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:29 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:38 2026 -0400" }, "message": "audio/hfp-hf: Add hangup all calls support\n\nThis releases all calls except waiting calls. This includes\nmultiparty calls.\n" }, { "commit": "f7fd0acef7ee1955dde4640fc5f47cb266f352f9", "tree": "737ec1a558cc5e57e53fcee984836e8b459b9e57", "parents": [ "9e2a7ddbb178591ec3e30bf9bb942581c317f713" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:28 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:38 2026 -0400" }, "message": "shared/hfp: Add hangup all calls support\n\nThis releases all calls except waiting calls. This includes\nmultiparty calls.\n" }, { "commit": "9e2a7ddbb178591ec3e30bf9bb942581c317f713", "tree": "c91f9e2b8927dba54f467458bd287eef70fcb5cd", "parents": [ "89b91a4806fb76a26863f7e12e8a823c689d2e8c" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis.oss@gmail.com", "time": "Thu Oct 01 23:10:27 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:38 2026 -0400" }, "message": "client/player: Add MediaEndpoints for HFP HF codecs\n\nAssisted-by: Claude:claude-sonnet-5\n" }, { "commit": "89b91a4806fb76a26863f7e12e8a823c689d2e8c", "tree": "40d494aa70370fc785557c03299cc612e52bab91", "parents": [ "7878ae60a2e2ba01fed06bf2850fcebd93d37b62" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Thu Oct 01 23:10:26 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:38 2026 -0400" }, "message": "audio/hfp-hf: Add MediaEndpoint for HFP codecs\n\nRegister a MediaEndpoint1 (org.bluez.MediaEndpoint1) for each HFP\ncodec supported by the remote AG, exposing SCO audio through the\nstandard media transport API.\n\nAdds a SCO listening/connecting socket in hfp-hf, endpoint\nregistration/unregistration tied to the HFP connection lifecycle,\nand wires MediaTransport creation/configuration for the HFP_AG_UUID\nendpoint in media.c.\n\nAssisted-by: Claude:claude-sonnet-5\n" }, { "commit": "7878ae60a2e2ba01fed06bf2850fcebd93d37b62", "tree": "43df698dcce16d4e67bba4e1171444a3ed5ebdb4", "parents": [ "4dc15be8ee3f7422d447087f1893d215575cb2c8" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Thu Oct 01 23:10:25 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Oct 05 16:07:37 2026 -0400" }, "message": "audio/hfp-hf: Add HFP HF server and SDP record\n" }, { "commit": "4dc15be8ee3f7422d447087f1893d215575cb2c8", "tree": "28b11581afe414b04f7570d71e9beadcb2120a77", "parents": [ "82f671c83429aa3548a26c92e05d3e7125356068" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:17 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:25 2026 -0400" }, "message": "client: Print discoverable broadcasters in red\n\nThis prints devices in red when they set the discoverable flags but are\nnot connectable, to warn the user they cannot be connected to despite\nbeing discoverable.\n" }, { "commit": "82f671c83429aa3548a26c92e05d3e7125356068", "tree": "66c2ad13bb511de0dcbe4860e9c9726cf7cc5a09", "parents": [ "ab50d5e88fb652f1a1c35336c1aab632b2e80993" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:16 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:24 2026 -0400" }, "message": "client: Print Connectable in info\n\nThis prints the Connectable property of the device and its bearers with\nthe likes of info command:\n\nbluetoothctl\u003e info \u003caddr\u003e\n...\n Connectable: yes\n...\n LE.Connectable: yes\n" }, { "commit": "ab50d5e88fb652f1a1c35336c1aab632b2e80993", "tree": "ea159e78ef3f9412192e821b7560c38239c69983", "parents": [ "6afb6e729270a3e85f020c724baae621a413fc8e" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:15 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:24 2026 -0400" }, "message": "bearer: Add Connectable property\n\nThis implements Connectable property for both bearers. For LE it\nreflects whether the last advertising report was connectable, and\nPropertiesChanged is emitted from device_update_last_seen when it\nchanges or first becomes known. BREDR always reports it as true.\n" }, { "commit": "6afb6e729270a3e85f020c724baae621a413fc8e", "tree": "5ef1a8d5e8118b5c174ce25975a225a35a55f94c", "parents": [ "f890d4b660c664ccca0e146ecfd2d58688f917d7" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:14 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:24 2026 -0400" }, "message": "device: Add Connectable property\n\nThis implements Connectable property using device_is_connectable, which\nreports whether the last advertising report on the device\u0027s bearer was\nconnectable, and emits PropertiesChanged from device_update_last_seen\nwhen the value changes or first becomes known.\n" }, { "commit": "f890d4b660c664ccca0e146ecfd2d58688f917d7", "tree": "cb00e228c962cf1d6e6c5922af9e9b5e3d079dee", "parents": [ "75a778e17f49560097c684058a9ff814e2279bfc" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:13 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:24 2026 -0400" }, "message": "org.bluez.Bearer: Add Connectable property\n\nThis adds Connectable property to org.bluez.Bearer.LE1 and\norg.bluez.Bearer.BREDR1, so it is possible to tell which bearer of a\ndual-mode device accepts connections, since Device1.Connectable is\nalways true for them as BREDR is always considered connectable.\n" }, { "commit": "75a778e17f49560097c684058a9ff814e2279bfc", "tree": "1704aaad35cd3399731f169d7b69a66dc912a639", "parents": [ "7a55a67cb49bce2e302963ee0fca627ec3b270c7" ], "author": { "name": "Kevin Dewald", "email": "kevin@simpleble.org", "time": "Thu Oct 01 22:46:12 2026 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:40:23 2026 -0400" }, "message": "org.bluez.Device: Add Connectable property\n\nThis adds Connectable property which indicates whether the remote\ndevice accepts connections, as reported by its last advertising report\nor inquiry result.\n\nbluetoothd already tracks this per bearer from the Device Found event,\nbut it is not exposed over D-Bus, so applications cannot tell\nconnectable advertisers such as peripherals from non-connectable ones\nsuch as beacons without attempting a connection.\n" }, { "commit": "7a55a67cb49bce2e302963ee0fca627ec3b270c7", "tree": "ca57c5c33d372e8a6cc6806ea225a39e82888bfc", "parents": [ "ae69dcddd5495c7c72b7935e12e17cf6d6b28461" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:35:28 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Oct 02 10:35:28 2026 -0400" }, "message": "mgmt-tester: Fix LE Security Level Changed expected encryption type\n\nLE pairing results in an AES-CCM encrypted link, so expect\nMGMT_CONN_SEC_ENCRYPT_AES_CCM instead of MGMT_CONN_SEC_ENCRYPT_NONE,\nwhich only matched the event emitted on connection before pairing.\n\nFixes: 74334ac97049 (\"mgmt-tester: Add Security Level Changed event tests\")\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "ae69dcddd5495c7c72b7935e12e17cf6d6b28461", "tree": "8cd6103cdfa06dfd9c642d793197e31eb146d1c2", "parents": [ "d3f2b6f3e142427f21eede2e7379f28e22b106c6" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:53 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:50:00 2026 -0400" }, "message": "client: Display SecurityLevel in device info\n" }, { "commit": "d3f2b6f3e142427f21eede2e7379f28e22b106c6", "tree": "16faa08f49c76c5c276106bc94e942d2abd29338", "parents": [ "09e58eb8da1b4d65857db900b8914173ecdd5644" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:52 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:49:57 2026 -0400" }, "message": "org.bluez.Device: Add Security Level related properties\n\nThis adds the SecurityLevel and EncryptionType properties which can be\nused by clients to get the security level and encryption type in use\nfor a connection.\n" }, { "commit": "09e58eb8da1b4d65857db900b8914173ecdd5644", "tree": "0e44a35c9a29f339ea098ec8bccff104a42cf74b", "parents": [ "1391af1995a9b07a344e872d019447e315ef0486" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:51 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:49:57 2026 -0400" }, "message": "device: Add SecurityLevel properties to org.bluez.Device1\n\nThis uses the new MGMT_EV_SECURITY_LEVEL_CHANGED event.\n\nIt will be used by btpclient to reduce test time.\n" }, { "commit": "1391af1995a9b07a344e872d019447e315ef0486", "tree": "ba97291afb48ba90710ec087584a0c8266d12175", "parents": [ "74334ac97049c8d878de9b76e6f89f0393a2c202" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:50 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:49:57 2026 -0400" }, "message": "monitor: Add support for Mgmt Security Level changed event\n\n@ MGMT Event: Security Level Changed (0x0034) plen 16\n BR/EDR Address: 00:AA:01:01:00:00 (Intel Corporation)\n Security Level: No security (0x00000000)\n Encryption Type: No encryption (0x00000000)\n" }, { "commit": "74334ac97049c8d878de9b76e6f89f0393a2c202", "tree": "0b2a3588831ffde908772dee90ec0e0db4599646", "parents": [ "bb98c3e02282c0383aa75651d754afd50fc385d2" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:49 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:49:56 2026 -0400" }, "message": "mgmt-tester: Add Security Level Changed event tests\n\nTest that MGMT_EV_SECURITY_LEVEL_CHANGED is correctly received during\nBREDR and LE secured connection.\n\nAssisted-by: GPT:GPT-5.3-Codex\n" }, { "commit": "bb98c3e02282c0383aa75651d754afd50fc385d2", "tree": "65f63de0ba0e32e2419bc7203025d4ead70634c8", "parents": [ "2f1ae1462507a1e1a9eb33bfc88d3b8741b50e80" ], "author": { "name": "Frédéric Danis", "email": "frederic.danis@collabora.com", "time": "Tue Sep 29 12:19:48 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 12:49:56 2026 -0400" }, "message": "mgmt: Add Security Level Changed event\n\nThis provides a TLV list of values related to the security level of\nthe connection to a remote device.\n\nCurrently Security Level and Encryption type are implemented.\n" }, { "commit": "2f1ae1462507a1e1a9eb33bfc88d3b8741b50e80", "tree": "f51937f08be09ca931015d100973182bd4f964bb", "parents": [ "17ea5080c481c2acfb6c532f602bf2028deba918" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 11:06:38 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 11:06:38 2026 -0400" }, "message": "Add AGENTS.md symlink to doc/coding-assistants.rst\n\nLet AI coding assistants that look for AGENTS.md load the guidelines\nautomatically.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "17ea5080c481c2acfb6c532f602bf2028deba918", "tree": "62543909c6bb02571604293640f860973697b2d0", "parents": [ "798da8d7ace22ff23c0644d4fd92c67997638280" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 11:03:16 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 11:03:30 2026 -0400" }, "message": "doc: Add bug fixing procedure for AI coding assistants\n\nRequire AI assistants fixing bugs to verify them with a reproducer, test\nthe fix, state what could not be verified and leave any submission to\nthe human, with vulnerabilities following SECURITY.md.\n\nAdapted from the Linux kernel\u0027s\nDocumentation/process/coding-assistants.rst.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "798da8d7ace22ff23c0644d4fd92c67997638280", "tree": "7c59359744393fcd41d44da478ffb8075449f4cc", "parents": [ "549f3d50686bbf18f01b949a913ddd10cb6e8b5c" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 10:55:55 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Oct 01 10:59:14 2026 -0400" }, "message": "doc: Add commit message guidelines for AI coding assistants\n\nRequire commit messages to record only the changes and their rationale,\nto follow Rule 2 of the maintainer guidelines, and to have their factual\nclaims checked against the diff.\n\nInspired by WirePlumber\u0027s AGENTS.md:\nhttps://gitlab.freedesktop.org/pipewire/wireplumber/-/blob/master/AGENTS.md\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "549f3d50686bbf18f01b949a913ddd10cb6e8b5c", "tree": "62b9570ecbe144ae841a92ecf88e758b88d60206", "parents": [ "05870ea62923caa4a7de233e733dea8bf77223d7" ], "author": { "name": "Jinwang Li", "email": "jinwang.li@oss.qualcomm.com", "time": "Wed Sep 30 15:39:53 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Sep 30 11:16:38 2026 -0400" }, "message": "obexd: Fix FILE* leak in phonebook-dummy\n\nfdopen(fd, \"r\") transfers ownership of fd to the FILE stream, but the\nloop was calling close(fd) directly instead of fclose(fp), leaking the\nFILE structure and its stdio buffer on every vCard read. Also handle\nfdopen() failure, which was previously unchecked.\n" }, { "commit": "05870ea62923caa4a7de233e733dea8bf77223d7", "tree": "ef45cd0f3cb36cc1cc737155a4366e3fe248e4a5", "parents": [ "a086d234e503daf6260fec61b7f4fd8f1028e165" ], "author": { "name": "Cheng Jiang", "email": "cheng.jiang@oss.qualcomm.com", "time": "Wed Sep 30 13:45:28 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Sep 30 11:15:09 2026 -0400" }, "message": "ranging: Route CS subevent results by connection and configuration\n\nbt_rap_attach_hci() allocates a state machine per device and registers the\nCS subevent handlers of each one on the shared bt_hci. LE Meta subevents\nare dispatched with queue_foreach() over every registered handler, so each\nCS Subevent Result is delivered to all of them, not only to the device the\nevent belongs to.\n\nThe Subevent Result and Subevent Result Continue handlers then passed their\nown sm-\u003erap on without checking which connection reported the event, unlike\nevery other handler in rap_hci.c, which resolves it with\nfind_mapping_by_handle() and returns when the connection is not its own.\nThe Connection_Handle was parsed into the event and never read again, in\nrap_hci.c or in shared/rap.c.\n\nWith two CS connections up, one set of ranging data was therefore consumed\nby both sessions and sent out over both peers\u0027 RAS characteristics. Resolve\nthe mapping and drop the subevent when the connection is not tracked.\n\nhandle_local_subevent_result() and parse_cs_local_initiator_data() also\ntook a config_id they never checked against the tracked one, so subevents\nbelonging to a second CS configuration on the same connection were\nappended to the procedure of the first. Ignore a subevent whose config_id\ndoes not match the tracker, once the tracker has one.\n\nAssisted-by: Claude:claude-opus-4.8\n" }, { "commit": "a086d234e503daf6260fec61b7f4fd8f1028e165", "tree": "955fede02302e1c48f8d896e41928b8bef55e417", "parents": [ "eda4262191ba00ab6912f54c86c2cdacc2f8b8d9" ], "author": { "name": "Seonggon Cho", "email": "jmsmg1@me.com", "time": "Tue Sep 29 02:45:30 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Sep 30 11:15:09 2026 -0400" }, "message": "mpris-proxy: Line-buffer stdout\n\nmpris-proxy reports adapter and player changes with printf() but never\nflushes stdout. When it runs as a service (tools/mpris-proxy.service)\nstdout is a pipe to the journal, so glibc fully buffers it and nothing\nis written until 4 KiB have accumulated or the process exits.\n\nOn a system whose Bluetooth adapter went away and came back every two\nminutes, the \"Bluetooth Adapter /org/bluez/hci0 removed\" and \"... found\"\nmessages reached the journal in bursts of exactly 100 lines (about\n4096 bytes), all carrying the timestamp of the flush rather than of the\nevent, i.e. up to about 80 minutes late.\n\nSet stdout to line buffered at startup, as bt_shell_init() already does,\nso every message reaches the journal with an accurate timestamp.\n\nAssisted-by: Claude:claude-fable-5-1\n" }, { "commit": "eda4262191ba00ab6912f54c86c2cdacc2f8b8d9", "tree": "e74c2aee14cffdaed0213d4f5b2e1b09843135cc", "parents": [ "dbc6102ccdeee4a09caa33ed73ab28de88cf2e92" ], "author": { "name": "Kun Ma", "email": "mk02092022@gmail.com", "time": "Wed Sep 30 18:12:40 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed Sep 30 11:15:09 2026 -0400" }, "message": "audio: Fix stale AVDTP connecting state\n\nWhen a remote dual-role A2DP device reconnects autonomously, both sink\nand source services transition to their respective CONNECTING states\nupon AVDTP_SESSION_STATE_CONNECTING.\n\nIf the remote device only configures one direction (e.g. initiating a\nstream from remote Source to local Sink), the unused direction\u0027s state\nremains stuck in CONNECTING even after the underlying AVDTP session has\nreached AVDTP_SESSION_STATE_CONNECTED.\n\nSubsequently, when policy or userspace attempts to initiate audio\nplayback (e.g. via sink_connect() or source_connect()), the call fails\nimmediately with -EBUSY due to this stale CONNECTING state.\n\nFix this by only returning -EBUSY if the underlying AVDTP session is\nactually still in AVDTP_SESSION_STATE_CONNECTING. In addition, check if\na stream already exists on that service to prevent concurrent stream\nallocations while the session is connected.\n\nLink: https://github.com/bluez/bluez/issues/2381\n" }, { "commit": "dbc6102ccdeee4a09caa33ed73ab28de88cf2e92", "tree": "de4efce85d0fef2df4f13a6c13c75ea129f7d948", "parents": [ "a7da60ed45e9b7aea429f1472588c9070ebecdf7" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Sep 28 11:49:08 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:34:10 2026 -0400" }, "message": "attrib: Remove directory\n\nWhat is left of attrib is only used by bluetoothd: att_ecode2str, which\nis moved to src/shared/att as bt_att_ecode2str, and struct gatt_primary\nalong with gatt_parse_record, which are moved to src/device, so remove\nthe attrib directory.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "a7da60ed45e9b7aea429f1472588c9070ebecdf7", "tree": "c47dc3edba74daf422e2fc2763609c8eb0ff7aea", "parents": [ "9d09a446ace8eaa0ca2a52ca70e294daee7efffd" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 18:22:18 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:34:10 2026 -0400" }, "message": "attrib: Remove GAttrib and gatttool\n\nGAttrib has no users left besides the deprecated gatttool, which is\nreplaced by the gatt submenu of bluetoothctl and btgatt-client, so\nremove both along with unit/test-gattrib and what is left unused of\nattrib/gatt.c, only keeping struct gatt_primary and gatt_parse_record\nwhich are still used by bluetoothd.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "9d09a446ace8eaa0ca2a52ca70e294daee7efffd", "tree": "af0ca70e4b4ea27e6220ec6f37db7e024bfee66a", "parents": [ "ed0b991aa5b2d4f8eb00d09d418c46d8ef5bfecc" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 18:22:01 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:31:29 2026 -0400" }, "message": "device: Use bt_att instead of GAttrib\n\nGAttrib is no longer used other than to create the bt_att of the\nconnection, so create it directly, and remove btd_device_get_attrib as\nthere are no users left.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "ed0b991aa5b2d4f8eb00d09d418c46d8ef5bfecc", "tree": "e8126414d95d97dad22b90345b0acd323415afdd", "parents": [ "bb69738a1206c895b6cb25e71add297c10d62f1b" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 17:46:19 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "unit/test-uhid: Add Get Report tests\n\nAdd tests replying to UHID_GET_REPORT for a numbered Feature Report:\n\n- /uhid/command/get_report_reply checks the reply contains the Report\n ID followed by the report data, with its size accounting for both\n- /uhid/device/get_report creates a uHID device, requests the report\n through hidraw with HIDIOCGFEATURE and checks it returns the Report ID\n followed by the report data, as documented in\n Documentation/hid/hidraw.rst, since uhid copies the reply to the buffer\n of hid_hw_raw_request. It requires root and CONFIG_HIDRAW, otherwise\n it is not run.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "bb69738a1206c895b6cb25e71add297c10d62f1b", "tree": "f6523aee7c7d8fbce8bccecf906f7cc2dcabd03d", "parents": [ "96f1201f5ac298860889714fcbc81307c2827dc0" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 17:46:08 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "doc: Add CONFIG_HIDRAW to the tester kernel config\n\nEnable hidraw so unit/test-uhid, when run as root e.g. with test-runner,\ncan request reports through a hidraw device, as HIDIOCGFEATURE does, and\ncheck the replies to the requests the kernel sends to the uHID device.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "96f1201f5ac298860889714fcbc81307c2827dc0", "tree": "173c9418be452c8c83befcb357dcda110d5cc1f7", "parents": [ "c2f53b0343484424d32700f8da3c674a2666956c" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 17:10:00 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "input/hog: Use shared/hog\n\nUse src/shared/hog, based on bt_gatt_client, instead of hog-lib which\nis based on GAttrib, and remove it along with the GAttrib based Battery,\nDevice Information and Scan Parameters implementations only used by it.\n\nThese services are handled by the battery, deviceinfo and scanparam\nplugins, so the vendor, product and version of the uHID device are\nset from the device, which gets them from the PnP ID, when accepting\nthe connection.\n\nWith shared/hog the notifications of HID SCI Mode are enabled when the\nHID device supports SCI, so the mode is known once changed with the HID\nControl Point.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "c2f53b0343484424d32700f8da3c674a2666956c", "tree": "394925102b70356a8cfccd35d1fca87122f44a3d", "parents": [ "7af5798ddb42a77db19512bbd4979c567f7fece3" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 17:10:00 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "test: functional: change the HoG SCI mode with the HID Control Point\n\nAs specified by HOGP.TS 4.6.1 and the HIDS/HOGP SCI FIPD, the HID host\nrequests a HID SCI mode by writing it to the HID Control Point, the HID\ndevice then confirming it with a notification of HID SCI Mode, which is\nRead and Notify only.\n\nWrite the mode to the HID Control Point instead of HID SCI Mode, which\nis no longer writable, and don\u0027t expect HID SCI Mode notifications to\nbe subscribed by bluetoothctl as the input plugin of the HID host may\nalready have done it.\n\nThe connection rate is still changed by the HID host, as the kernel\nonly issues the LE Connection Rate Request as central.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "7af5798ddb42a77db19512bbd4979c567f7fece3", "tree": "f58e47f35471f735ea83ae12904d74bd3c449a6b", "parents": [ "c2f56f58b8b7dd686329edd2e294a000e43b7dcc" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 14:55:54 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "unit/test-hog: Use shared/hog\n\nPort the tests to src/shared/hog, with the discovery done by\nbt_gatt_client, and the uHID device emulated with a socket pair so the\nevents are checked.\n\nThe test cases are renamed after HOGP.TS p13, and the missing ones for\nthe Report Host are added, except for HID ISO which is not supported:\n\n- Discovery: HGDC/BV-03-C (two instances of the HID Service),\n HGDC/BV-04-C and HGDC/BV-05-C\n- Read: HGRF/BV-02-C to BV-08-C, BV-18-C and BV-19-C, with the Report\n values also read with UHID_GET_REPORT\n- Write: HGWF/BV-01-C, BV-02-C and BV-04-C with UHID_SET_REPORT and\n UHID_OUTPUT, BV-05-C and BV-06-C (Suspend and Exit Suspend), BV-07-C\n (Set Report Protocol Mode)\n- HID SCI: HGWF/BV-08-C to BV-11-C, writing each mode to the HID\n Control Point with two instances of the HID Service, then changing\n to another mode once notified with HID SCI Mode\n- Configuration: HGCF/BV-01-C\n- Notifications: HGNF/BV-01-C, forwarded as UHID_INPUT2, and BI-01-C\n and BI-02-C, ignoring the Boot Keyboard and Boot Mouse Input Reports,\n and HGNF/BV-01-C once reconnected, with the reports already known and\n the Report Map cached\n- Characteristic GGIT: CHA/BV-01-C to BV-04-C, BV-09-C, BV-10-C and\n DES/BV-01-C\n\nThe Battery Level and PnP ID GGIT test cases are left to the battery\nand deviceinfo plugins which handle these services.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" }, { "commit": "c2f56f58b8b7dd686329edd2e294a000e43b7dcc", "tree": "5fefe231c31605ef0cbdd0c75ee8146f6e6376d1", "parents": [ "06053830b71c74a1f376ae4b55d2a4fb73ce7c6f" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Sep 24 14:09:57 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Sep 29 16:22:31 2026 -0400" }, "message": "shared/hog: Add initial implementation\n\nAdd a HID over GATT implementation based on bt_gatt_client and\ngatt_db, meant as a drop-in replacement of profiles/input/hog-lib\nwhich is based on GAttrib:\n\n- bt_hog_attach takes a bt_gatt_client, which is cloned so the requests\n of HoG are tracked and cancelled on their own\n- the services and characteristics are only looked up in the gatt_db,\n the one given to bt_hog_new or otherwise the one of the client\n- notifications of the Input Reports are enabled with\n bt_gatt_client_register_notify, once their CCC has been read\n- the Report Map is read along with the other characteristics, with a\n long read, and the uHID device is created once the client is idle,\n i.e. every request is complete, so the report IDs are known by then\n- the addresses of the uHID device are taken from the ATT socket\n- the clone is freed when detaching, which cancels its pending requests\n and unregisters its notifications\n- static values, i.e. HID Information, Report Reference, External Report\n Reference and HID SCI Information, are cached in the gatt_db, along\n with the Report Map, so they are not read again when reconnecting\n\nUnlike hog-lib, the Scan Parameters, Device Information and Battery\nservices are not handled, as they are by the scanparam, deviceinfo and\nbattery plugins, so bt_hog_set_ids is added to set the vendor, product\nand version once known, e.g. from the PnP ID. A debug callback can be\nset with bt_hog_set_debug.\n\nHID SCI is supported as specified by the HIDS/HOGP SCI FIPD:\nbt_hog_set_sci_mode requests the HID Device to enable a HID SCI mode by\nwriting it to the HID Control Point, and the notifications of HID SCI\nMode, with which the HID Device confirms the mode once the connection\nrate has been changed, are enabled and reported with the callback set\nwith bt_hog_set_sci_mode_callback.\n\nAssisted-by: OpenCode:claude-opus-5.5\n" } ], "next": "06053830b71c74a1f376ae4b55d2a4fb73ce7c6f" }