[PATCH BlueZ v5 0/3] Code handling for VOCS service

[PATCH BlueZ v5 0/3] Code handling for VOCS service

[Nitin Jadhav]

Hello Maintainers

This patch series handles code implementation for mandatory features of Volume Offset Control Service.

Implementation of following features have been handled in this patch series
- Volume Offset Control Service
- Volume Offset State Characteristic (Read, Notify)
- Audio Location Characteristic (Read)
- Volume Offset Control Point Characteristic (Write)	
- Audio Output Description Characteristic (Read)
- Set Volume Offset

Reference Document:
- Code implementation is based on VOCS_v1.0.pdf
- Testing is done using PTS in reference to VOCS.TS.p1.pdf
- The verdict is PASS for all mandatory test cases.

Thank you in advance for your review.

Warm Regards
Nitin Jadhav

Nitin Jadhav (3):
  lib/uuid.h: Add VOCS characteristic uuid(s)
  shared/vcp: Add initial code for handling VOCS
  shared/vcp.c: Make VOCS as an included service of VCS

 lib/uuid.h       |   5 +
 src/shared/vcp.c | 565 ++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 568 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH BlueZ v5 1/3] lib/uuid.h: Add VOCS characteristic uuid(s)

[Nitin Jadhav]

---
 lib/uuid.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/uuid.h b/lib/uuid.h
index 5cdfedb4b..cd3b3655f 100644
--- a/lib/uuid.h
+++ b/lib/uuid.h
@@ -179,6 +179,11 @@ extern "C" {
 #define VOL_CP_CHRC_UUID				0x2B7E
 #define VOL_FLAG_CHRC_UUID				0x2B7F
 
+#define VOCS_STATE_CHAR_UUID			0x2B80
+#define VOCS_AUDIO_LOC_CHRC_UUID		0x2B81
+#define VOCS_CP_CHRC_UUID			0x2B82
+#define VOCS_AUDIO_OP_DESC_CHAR_UUID		0x2B83
+
 #define GMCS_UUID                               0x1849
 #define MEDIA_PLAYER_NAME_CHRC_UUID             0x2b93
 #define MEDIA_TRACK_CHNGD_CHRC_UUID             0x2b96
-- 
2.34.1

RE: Code handling for VOCS service

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 948 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=756305

---Test result---

Test Summary:
CheckPatch                    PASS      2.06 seconds
GitLint                       PASS      1.07 seconds
BuildEll                      PASS      27.19 seconds
BluezMake                     PASS      832.60 seconds
MakeCheck                     PASS      12.59 seconds
MakeDistcheck                 PASS      155.45 seconds
CheckValgrind                 PASS      255.24 seconds
CheckSmatch                   PASS      341.05 seconds
bluezmakeextell               PASS      103.39 seconds
IncrementalBuild              PASS      2068.15 seconds
ScanBuild                     PASS      1044.52 seconds



---
Regards,
Linux Bluetooth

[PATCH BlueZ v5 2/3] shared/vcp: Add initial code for handling VOCS

[Nitin Jadhav]

Summary:
- This adds implementation for VOCS service and characteristics
- Implementation based on VOCS_v1.0.pdf specification
- Tested using PTS with reference to VOCS.TS.p1.pdf
---
v2: Corrected prefixs and cosmetic changes (Luiz Augusto von Dentz)
v3: Commit message modified and fixed long line length warning (Paul
Menzel)
v4: Used BIT macro to set bit of audio location macros (Luiz Augusto von Dentz)
v5: Resolved Scan Build warning (tedd_an/ScanBuild)
---
 src/shared/vcp.c | 550 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 550 insertions(+)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 5459cf892..92f21fd0b 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -36,9 +36,40 @@
 #define BT_ATT_ERROR_INVALID_CHANGE_COUNTER	0x80
 #define BT_ATT_ERROR_OPCODE_NOT_SUPPORTED	0x81
 
+#define BT_VCP_NA                   BIT(0)
+#define BT_VCP_FRONT_LEFT           BIT(1)
+#define BT_VCP_FRONT_RIGHT          BIT(2)
+#define BT_VCP_FRONT_CENTER         BIT(3)
+#define BT_VCP_LOW_FRQ_EFF_1        BIT(4)
+#define BT_VCP_BACK_LEFT            BIT(5)
+#define BT_VCP_BACK_RIGHT           BIT(6)
+#define BT_VCP_FRONT_LEFT_CENTER    BIT(7)
+#define BT_VCP_FRONT_RIGHT_CENTER   BIT(8)
+#define BT_VCP_BACK_CENTER          BIT(9)
+#define BT_VCP_LOW_FRQ_EFF_2        BIT(10)
+#define BT_VCP_SIDE_LEFT            BIT(11)
+#define BT_VCP_SIDE_RIGHT           BIT(12)
+#define BT_VCP_TOP_FRONT_LEFT       BIT(13)
+#define BT_VCP_TOP_FRONT_RIGHT      BIT(14)
+#define BT_VCP_TOP_FRONT_CENTER     BIT(15)
+#define BT_VCP_TOP_CENTER           BIT(16)
+#define BT_VCP_TOP_BACK_LEFT        BIT(17)
+#define BT_VCP_TOP_BACK_RIGHT       BIT(18)
+#define BT_VCP_TOP_SIDE_LEFT        BIT(19)
+#define BT_VCP_TOP_SIDE_RIGHT       BIT(20)
+#define BT_VCP_TOP_BACK_CENTER      BIT(21)
+#define BT_VCP_BOTTOM_FRONT_CENTER  BIT(22)
+#define BT_VCP_BOTTOM_FRONT_LEFT    BIT(23)
+#define BT_VCP_BOTTOM_FRONT_RIGHT   BIT(24)
+#define BT_VCP_FRONT_LEFT_WIDE      BIT(25)
+#define BT_VCP_FRONT_RIGHT_WIDE     BIT(26)
+#define BT_VCP_LEFT_SURROUND        BIT(27)
+#define BT_VCP_RIGHT_SURROUND       BIT(28)
+
 struct bt_vcp_db {
 	struct gatt_db *db;
 	struct bt_vcs *vcs;
+	struct bt_vocs *vocs;
 };
 
 typedef void (*vcp_func_t)(struct bt_vcp *vcp, bool success, uint8_t att_ecode,
@@ -57,11 +88,21 @@ struct bt_vcs_param {
 	uint8_t	change_counter;
 } __packed;
 
+struct bt_vocs_param {
+	uint8_t	op;
+	uint8_t	change_counter;
+} __packed;
+
 struct bt_vcs_ab_vol {
 	uint8_t	change_counter;
 	uint8_t	vol_set;
 } __packed;
 
+struct bt_vocs_set_vol_off {
+	uint8_t	change_counter;
+	uint8_t	set_vol_offset;
+} __packed;
+
 struct bt_vcp_cb {
 	unsigned int id;
 	bt_vcp_func_t attached;
@@ -89,6 +130,10 @@ struct bt_vcp {
 	unsigned int vstate_id;
 	unsigned int vflag_id;
 
+	unsigned int state_id;
+	unsigned int audio_loc_id;
+	unsigned int ao_dec_id;
+
 	struct queue *notify;
 	struct queue *pending;
 
@@ -120,6 +165,27 @@ struct bt_vcs {
 	struct gatt_db_attribute *vf_ccc;
 };
 
+/* Contains local bt_vcp_db */
+struct vol_offset_state {
+	uint16_t vol_offset;
+	uint8_t counter;
+} __packed;
+
+struct bt_vocs {
+	struct bt_vcp_db *vdb;
+	struct vol_offset_state *vostate;
+	uint32_t vocs_audio_loc;
+	char *vocs_ao_dec;
+	struct gatt_db_attribute *service;
+	struct gatt_db_attribute *vos;
+	struct gatt_db_attribute *vos_ccc;
+	struct gatt_db_attribute *voal;
+	struct gatt_db_attribute *voal_ccc;
+	struct gatt_db_attribute *vo_cp;
+	struct gatt_db_attribute *voaodec;
+	struct gatt_db_attribute *voaodec_ccc;
+};
+
 static struct queue *vcp_db;
 static struct queue *vcp_cbs;
 static struct queue *sessions;
@@ -159,6 +225,17 @@ static struct vol_state *vdb_get_vstate(struct bt_vcp_db *vdb)
 	return NULL;
 }
 
+static struct vol_offset_state *vdb_get_vostate(struct bt_vcp_db *vdb)
+{
+	if (!vdb->vocs)
+		return NULL;
+
+	if (vdb->vocs->vostate)
+		return vdb->vocs->vostate;
+
+	return NULL;
+}
+
 static struct bt_vcs *vcp_get_vcs(struct bt_vcp *vcp)
 {
 	if (!vcp)
@@ -173,6 +250,20 @@ static struct bt_vcs *vcp_get_vcs(struct bt_vcp *vcp)
 	return vcp->rdb->vcs;
 }
 
+static struct bt_vocs *vcp_get_vocs(struct bt_vcp *vcp)
+{
+	if (!vcp)
+		return NULL;
+
+	if (vcp->rdb->vocs)
+		return vcp->rdb->vocs;
+
+	vcp->rdb->vocs = new0(struct bt_vocs, 1);
+	vcp->rdb->vocs->vdb = vcp->rdb;
+
+	return vcp->rdb->vocs;
+}
+
 static void vcp_detached(void *data, void *user_data)
 {
 	struct bt_vcp_cb *cb = data;
@@ -202,6 +293,7 @@ static void vcp_db_free(void *data)
 	gatt_db_unref(vdb->db);
 
 	free(vdb->vcs);
+	free(vdb->vocs);
 	free(vdb);
 }
 
@@ -583,6 +675,45 @@ static uint8_t vcs_mute(struct bt_vcs *vcs, struct bt_vcp *vcp,
 	return 0;
 }
 
+static uint8_t vocs_set_vol_offset(struct bt_vocs *vocs, struct bt_vcp *vcp,
+				struct iovec *iov)
+{
+	struct bt_vcp_db *vdb;
+	struct vol_offset_state *vstate;
+	struct bt_vocs_set_vol_off *req;
+
+	DBG(vcp, "Set Volume Offset");
+
+	vdb = vcp_get_vdb(vcp);
+	if (!vdb) {
+		DBG(vcp, "error: VDB not available");
+		return 0;
+	}
+
+	vstate = vdb_get_vostate(vdb);
+	if (!vstate) {
+		DBG(vcp, "error: VSTATE not available");
+		return 0;
+	}
+
+	req = iov_pull_mem(iov, sizeof(*req));
+	if (!req)
+		return 0;
+
+	if (req->change_counter != vstate->counter) {
+		DBG(vcp, "Change Counter Mismatch Volume not decremented!");
+		return BT_ATT_ERROR_INVALID_CHANGE_COUNTER;
+	}
+
+	vstate->vol_offset = req->set_vol_offset;
+	vstate->counter = -~vstate->counter; /*Increment Change Counter*/
+
+	gatt_db_attribute_notify(vdb->vocs->vos, (void *)vstate,
+				 sizeof(struct vol_offset_state),
+				 bt_vcp_get_att(vcp));
+	return 0;
+}
+
 #define	BT_VCS_REL_VOL_DOWN		0x00
 #define	BT_VCS_REL_VOL_UP		0x01
 #define	BT_VCS_UNMUTE_REL_VOL_DOWN	0x02
@@ -591,6 +722,8 @@ static uint8_t vcs_mute(struct bt_vcs *vcs, struct bt_vcp *vcp,
 #define	BT_VCS_UNMUTE			0x05
 #define	BT_VCS_MUTE			0x06
 
+#define BT_VOCS_SET_VOL_OFFSET	0x01
+
 #define VCS_OP(_str, _op, _size, _func) \
 	{ \
 		.str = _str, \
@@ -623,6 +756,26 @@ struct vcs_op_handler {
 	{}
 };
 
+#define VOCS_OP(_str, _op, _size, _func) \
+	{ \
+		.str = _str, \
+		.op = _op, \
+		.size = _size, \
+		.func = _func, \
+	}
+
+struct vocs_op_handler {
+	const char *str;
+	uint8_t	op;
+	size_t	size;
+	uint8_t	(*func)(struct bt_vocs *vocs, struct bt_vcp *vcp,
+			struct iovec *iov);
+} vocp_handlers[] = {
+	VOCS_OP("Set Volume Offset", BT_VOCS_SET_VOL_OFFSET,
+		sizeof(uint8_t), vocs_set_vol_offset),
+	{}
+};
+
 static void vcs_cp_write(struct gatt_db_attribute *attrib,
 				unsigned int id, uint16_t offset,
 				const uint8_t *value, size_t len,
@@ -683,6 +836,66 @@ respond:
 	gatt_db_attribute_write_result(attrib, id, ret);
 }
 
+static void vocs_cp_write(struct gatt_db_attribute *attrib,
+				unsigned int id, uint16_t offset,
+				const uint8_t *value, size_t len,
+				uint8_t opcode, struct bt_att *att,
+				void *user_data)
+{
+	struct bt_vocs *vocs = user_data;
+	struct bt_vcp *vcp = vcp_get_session(att, vocs->vdb->db);
+	struct iovec iov = {
+		.iov_base = (void *) value,
+		.iov_len = len,
+	};
+	uint8_t	*vcp_op;
+	struct vocs_op_handler *handler;
+	uint8_t ret = BT_ATT_ERROR_REQUEST_NOT_SUPPORTED;
+
+	DBG(vcp, "VOCP Control Point Write");
+
+	if (offset) {
+		DBG(vcp, "invalid offset %d", offset);
+		ret = BT_ATT_ERROR_INVALID_OFFSET;
+		goto respond;
+	}
+
+	if (len < sizeof(*vcp_op)) {
+		DBG(vcp, "invalid len %ld < %ld sizeof(*param)", len,
+							sizeof(*vcp_op));
+		ret = BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN;
+		goto respond;
+	}
+
+	vcp_op = iov_pull_mem(&iov, sizeof(*vcp_op));
+
+	for (handler = vocp_handlers; handler && handler->str; handler++) {
+		if (handler->op != *vcp_op)
+			continue;
+
+		if (iov.iov_len < handler->size) {
+			DBG(vcp, "invalid len %ld < %ld handler->size", len,
+			    handler->size);
+			ret = BT_ATT_ERROR_OPCODE_NOT_SUPPORTED;
+			goto respond;
+		}
+
+		break;
+	}
+
+	if (handler && handler->str) {
+		DBG(vcp, "%s", handler->str);
+
+		ret = handler->func(vocs, vcp, &iov);
+	} else {
+		DBG(vcp, "Unknown opcode 0x%02x", *vcp_op);
+		ret = BT_ATT_ERROR_OPCODE_NOT_SUPPORTED;
+	}
+
+respond:
+	gatt_db_attribute_write_result(attrib, id, ret);
+}
+
 static void vcs_state_read(struct gatt_db_attribute *attrib,
 				unsigned int id, uint16_t offset,
 				uint8_t opcode, struct bt_att *att,
@@ -698,6 +911,21 @@ static void vcs_state_read(struct gatt_db_attribute *attrib,
 							iov.iov_len);
 }
 
+static void vocs_state_read(struct gatt_db_attribute *attrib,
+				unsigned int id, uint16_t offset,
+				uint8_t opcode, struct bt_att *att,
+				void *user_data)
+{
+	struct bt_vocs *vocs = user_data;
+	struct iovec iov;
+
+	iov.iov_base = vocs->vostate;
+	iov.iov_len = sizeof(*vocs->vostate);
+
+	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
+							iov.iov_len);
+}
+
 static void vcs_flag_read(struct gatt_db_attribute *attrib,
 				unsigned int id, uint16_t offset,
 				uint8_t opcode, struct bt_att *att,
@@ -713,6 +941,36 @@ static void vcs_flag_read(struct gatt_db_attribute *attrib,
 							iov.iov_len);
 }
 
+static void vocs_voal_read(struct gatt_db_attribute *attrib,
+				unsigned int id, uint16_t offset,
+				uint8_t opcode, struct bt_att *att,
+				void *user_data)
+{
+	struct bt_vocs *vocs = user_data;
+	struct iovec iov;
+
+	iov.iov_base = &vocs->vocs_audio_loc;
+	iov.iov_len = sizeof(vocs->vocs_audio_loc);
+
+	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
+							iov.iov_len);
+}
+
+static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
+				unsigned int id, uint16_t offset,
+				uint8_t opcode, struct bt_att *att,
+				void *user_data)
+{
+	struct bt_vocs *vocs = user_data;
+	struct iovec iov;
+
+	iov.iov_base = &vocs->vocs_ao_dec;
+	iov.iov_len = strlen(vocs->vocs_ao_dec);
+
+	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
+							iov.iov_len);
+}
+
 static struct bt_vcs *vcs_new(struct gatt_db *db)
 {
 	struct bt_vcs *vcs;
@@ -771,6 +1029,74 @@ static struct bt_vcs *vcs_new(struct gatt_db *db)
 	return vcs;
 }
 
+static struct bt_vocs *vocs_new(struct gatt_db *db)
+{
+	struct bt_vocs *vocs;
+	struct vol_offset_state *vostate;
+	bt_uuid_t uuid;
+
+	if (!db)
+		return NULL;
+
+	vocs = new0(struct bt_vocs, 1);
+
+	vostate = new0(struct vol_offset_state, 1);
+
+	vocs->vostate = vostate;
+	vocs->vocs_audio_loc = BT_VCP_FRONT_LEFT;
+	vocs->vocs_ao_dec = "Left Speaker";
+
+	/* Populate DB with VOCS attributes */
+	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
+	vocs->service = gatt_db_add_service(db, &uuid, true, 9);
+
+	bt_uuid16_create(&uuid, VOCS_STATE_CHAR_UUID);
+	vocs->vos = gatt_db_service_add_characteristic(vocs->service,
+					&uuid,
+					BT_ATT_PERM_READ,
+					BT_GATT_CHRC_PROP_READ |
+					BT_GATT_CHRC_PROP_NOTIFY,
+					vocs_state_read, NULL,
+					vocs);
+
+	vocs->vos_ccc = gatt_db_service_add_ccc(vocs->service,
+					BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+
+	bt_uuid16_create(&uuid, VOCS_AUDIO_LOC_CHRC_UUID);
+	vocs->voal = gatt_db_service_add_characteristic(vocs->service,
+					&uuid,
+					BT_ATT_PERM_READ,
+					BT_GATT_CHRC_PROP_READ |
+					BT_GATT_CHRC_PROP_NOTIFY,
+					vocs_voal_read, NULL,
+					vocs);
+
+	vocs->voal_ccc = gatt_db_service_add_ccc(vocs->service,
+					BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+
+	bt_uuid16_create(&uuid, VOCS_CP_CHRC_UUID);
+	vocs->vo_cp = gatt_db_service_add_characteristic(vocs->service,
+					&uuid,
+					BT_ATT_PERM_WRITE,
+					BT_GATT_CHRC_PROP_WRITE,
+					NULL, vocs_cp_write,
+					vocs);
+
+	bt_uuid16_create(&uuid, VOCS_AUDIO_OP_DESC_CHAR_UUID);
+	vocs->voaodec = gatt_db_service_add_characteristic(vocs->service,
+					&uuid,
+					BT_ATT_PERM_READ,
+					BT_GATT_CHRC_PROP_READ |
+					BT_GATT_CHRC_PROP_NOTIFY,
+					vocs_voaodec_read, NULL,
+					vocs);
+
+	vocs->voaodec_ccc = gatt_db_service_add_ccc(vocs->service,
+					BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+
+	return vocs;
+}
+
 static struct bt_vcp_db *vcp_db_new(struct gatt_db *db)
 {
 	struct bt_vcp_db *vdb;
@@ -787,6 +1113,9 @@ static struct bt_vcp_db *vcp_db_new(struct gatt_db *db)
 	vdb->vcs = vcs_new(db);
 	vdb->vcs->vdb = vdb;
 
+	vdb->vocs = vocs_new(db);
+	vdb->vocs->vdb = vdb;
+
 	queue_push_tail(vcp_db, vdb);
 
 	return vdb;
@@ -911,6 +1240,47 @@ static void vcp_vstate_notify(struct bt_vcp *vcp, uint16_t value_handle,
 	DBG(vcp, "Vol Counter 0x%x", vstate.counter);
 }
 
+static void vcp_voffset_state_notify(struct bt_vcp *vcp, uint16_t value_handle,
+				const uint8_t *value, uint16_t length,
+				void *user_data)
+{
+	struct vol_offset_state vostate;
+
+	memcpy(&vostate, value, sizeof(struct vol_offset_state));
+
+	DBG(vcp, "Vol Offset 0x%x", vostate.vol_offset);
+	DBG(vcp, "Vol Offset Counter 0x%x", vostate.counter);
+}
+
+static void vcp_audio_loc_notify(struct bt_vcp *vcp, uint16_t value_handle,
+				const uint8_t *value, uint16_t length,
+				void *user_data)
+{
+	uint32_t *vocs_audio_loc_n = malloc(sizeof(uint32_t));
+	*vocs_audio_loc_n = 0;
+
+	if (value != NULL)
+		memcpy(vocs_audio_loc_n, value, sizeof(uint32_t));
+
+	DBG(vcp, "VOCS Audio Location 0x%x", *vocs_audio_loc_n);
+
+	free(vocs_audio_loc_n);
+}
+
+
+static void vcp_audio_descriptor_notify(struct bt_vcp *vcp,
+					uint16_t value_handle,
+					const uint8_t *value,
+					uint16_t length,
+					void *user_data)
+{
+	char vocs_audio_dec_n[256] = {'\0'};
+
+	memcpy(vocs_audio_dec_n, value, length);
+
+	DBG(vcp, "VOCS Audio Descriptor 0x%s", *vocs_audio_dec_n);
+}
+
 static void vcp_vflag_notify(struct bt_vcp *vcp, uint16_t value_handle,
 			     const uint8_t *value, uint16_t length,
 			     void *user_data)
@@ -972,6 +1342,86 @@ static void read_vol_state(struct bt_vcp *vcp, bool success, uint8_t att_ecode,
 	DBG(vcp, "Vol Counter:%x", vs->counter);
 }
 
+static void read_vol_offset_state(struct bt_vcp *vcp, bool success,
+				  uint8_t att_ecode,
+				  const uint8_t *value, uint16_t length,
+				  void *user_data)
+{
+	struct vol_offset_state *vos;
+	struct iovec iov = {
+		.iov_base = (void *) value,
+		.iov_len = length,
+	};
+
+	if (!success) {
+		DBG(vcp, "Unable to read Vol Offset State: error 0x%02x",
+		    att_ecode);
+		return;
+	}
+
+	vos = iov_pull_mem(&iov, sizeof(*vos));
+	if (!vos) {
+		DBG(vcp, "Unable to get Vol Offset State");
+		return;
+	}
+
+	DBG(vcp, "Vol Set:%x", vos->vol_offset);
+	DBG(vcp, "Vol Counter:%x", vos->counter);
+}
+
+static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
+				     uint8_t att_ecode,
+				     const uint8_t *value, uint16_t length,
+				     void *user_data)
+{
+	uint32_t *vocs_audio_loc;
+	struct iovec iov = {
+		.iov_base = (void *) value,
+		.iov_len = length,
+	};
+
+	if (!success) {
+		DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
+		    att_ecode);
+		return;
+	}
+
+	vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
+	if (!*vocs_audio_loc) {
+		DBG(vcp, "Unable to get VOCS Audio Location");
+		return;
+	}
+
+	DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+}
+
+
+static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
+				       uint8_t att_ecode,
+				       const uint8_t *value, uint16_t length,
+				       void *user_data)
+{
+	char *vocs_ao_dec_r;
+	struct iovec iov = {
+		.iov_base = (void *) value,
+		.iov_len = length,
+	};
+
+	if (!success) {
+		DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
+			att_ecode);
+		return;
+	}
+
+	vocs_ao_dec_r = iov_pull_mem(&iov, length);
+	if (!*vocs_ao_dec_r) {
+		DBG(vcp, "Unable to get VOCS Audio Descriptor");
+		return;
+	}
+
+	DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+}
+
 static void vcp_pending_destroy(void *data)
 {
 	struct bt_vcp_pending *pending = data;
@@ -1128,6 +1578,90 @@ static void foreach_vcs_char(struct gatt_db_attribute *attr, void *user_data)
 	}
 }
 
+static void foreach_vocs_char(struct gatt_db_attribute *attr, void *user_data)
+{
+	struct bt_vcp *vcp = user_data;
+	uint16_t value_handle;
+	bt_uuid_t uuid, uuid_vostate, uuid_audio_loc, uuid_vo_cp,
+			uuid_audio_op_decs;
+	struct bt_vocs *vocs;
+
+	if (!gatt_db_attribute_get_char_data(attr, NULL, &value_handle,
+						NULL, NULL, &uuid))
+		return;
+
+	bt_uuid16_create(&uuid_vostate, VOCS_STATE_CHAR_UUID);
+	bt_uuid16_create(&uuid_audio_loc, VOCS_AUDIO_LOC_CHRC_UUID);
+	bt_uuid16_create(&uuid_vo_cp, VOCS_CP_CHRC_UUID);
+	bt_uuid16_create(&uuid_audio_op_decs, VOCS_AUDIO_OP_DESC_CHAR_UUID);
+
+	if (!bt_uuid_cmp(&uuid, &uuid_vostate)) {
+		DBG(vcp, "VOCS Vol state found: handle 0x%04x", value_handle);
+
+		vocs = vcp_get_vocs(vcp);
+		if (!vocs || vocs->vos)
+			return;
+
+		vocs->vos = attr;
+
+		vcp_read_value(vcp, value_handle, read_vol_offset_state, vcp);
+
+		vcp->state_id = vcp_register_notify(vcp, value_handle,
+					vcp_voffset_state_notify, NULL);
+
+		return;
+	}
+
+	if (!bt_uuid_cmp(&uuid, &uuid_audio_loc)) {
+		DBG(vcp, "VOCS Volume Audio Location found: handle 0x%04x",
+			value_handle);
+
+		vocs = vcp_get_vocs(vcp);
+		if (!vocs || vocs->voal)
+			return;
+
+		vocs->voal = attr;
+
+		vcp_read_value(vcp, value_handle, read_vocs_audio_location,
+				       vcp);
+
+		vcp->audio_loc_id = vcp_register_notify(vcp, value_handle,
+						vcp_audio_loc_notify, NULL);
+
+		return;
+	}
+
+	if (!bt_uuid_cmp(&uuid, &uuid_vo_cp)) {
+		DBG(vcp, "VOCS Volume CP found: handle 0x%04x", value_handle);
+
+		vocs = vcp_get_vocs(vcp);
+		if (!vocs || vocs->vo_cp)
+			return;
+
+		vocs->vo_cp = attr;
+
+		return;
+	}
+
+	if (!bt_uuid_cmp(&uuid, &uuid_audio_op_decs)) {
+		DBG(vcp, "VOCS Vol Audio Descriptor found: handle 0x%04x",
+			value_handle);
+
+		vocs = vcp_get_vocs(vcp);
+		if (!vocs || vocs->voaodec)
+			return;
+
+		vocs->voaodec = attr;
+
+		vcp_read_value(vcp, value_handle, read_vocs_audio_descriptor,
+			       vcp);
+		vcp->ao_dec_id = vcp_register_notify(vcp, value_handle,
+					vcp_audio_descriptor_notify, NULL);
+
+	}
+
+}
+
 static void foreach_vcs_service(struct gatt_db_attribute *attr,
 						void *user_data)
 {
@@ -1141,6 +1675,19 @@ static void foreach_vcs_service(struct gatt_db_attribute *attr,
 	gatt_db_service_foreach_char(attr, foreach_vcs_char, vcp);
 }
 
+static void foreach_vocs_service(struct gatt_db_attribute *attr,
+						void *user_data)
+{
+	struct bt_vcp *vcp = user_data;
+	struct bt_vocs *vocs = vcp_get_vocs(vcp);
+
+	vocs->service = attr;
+
+	gatt_db_service_set_claimed(attr, true);
+
+	gatt_db_service_foreach_char(attr, foreach_vocs_char, vcp);
+}
+
 bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
 {
 	bt_uuid_t uuid;
@@ -1163,6 +1710,9 @@ bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
 	bt_uuid16_create(&uuid, VCS_UUID);
 	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vcs_service, vcp);
 
+	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
+	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vocs_service, vcp);
+
 	return true;
 }
 
-- 
2.34.1

[PATCH BlueZ v5 3/3] shared/vcp.c: Make VOCS as an included service of VCS

[Nitin Jadhav]

Fixed the following issue observed during PTS testing
- Specified Upper and Lower Limit for Volume offset
- Corrected the number of handles for VOCS
- VOCS is made as included service of VCS
  (VOCS is secondary service and VSC is primary service)
---
v2: Cosmetic Changes (Bluez Test Bot)
v5: Resolved GitLint warning (tedd_an/GitLint)
---

 src/shared/vcp.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 92f21fd0b..74bd01729 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -32,9 +32,13 @@
 
 #define VCP_STEP_SIZE 1
 
+#define VOCS_VOL_OFFSET_UPPER_LIMIT	 255
+#define VOCS_VOL_OFFSET_LOWER_LIMIT	-255
+
 /* Apllication Error Code */
 #define BT_ATT_ERROR_INVALID_CHANGE_COUNTER	0x80
 #define BT_ATT_ERROR_OPCODE_NOT_SUPPORTED	0x81
+#define BT_ATT_ERROR_VALUE_OUT_OF_RANGE		0x82
 
 #define BT_VCP_NA                   BIT(0)
 #define BT_VCP_FRONT_LEFT           BIT(1)
@@ -100,7 +104,7 @@ struct bt_vcs_ab_vol {
 
 struct bt_vocs_set_vol_off {
 	uint8_t	change_counter;
-	uint8_t	set_vol_offset;
+	int16_t set_vol_offset;
 } __packed;
 
 struct bt_vcp_cb {
@@ -167,7 +171,7 @@ struct bt_vcs {
 
 /* Contains local bt_vcp_db */
 struct vol_offset_state {
-	uint16_t vol_offset;
+	int16_t vol_offset;
 	uint8_t counter;
 } __packed;
 
@@ -705,6 +709,11 @@ static uint8_t vocs_set_vol_offset(struct bt_vocs *vocs, struct bt_vcp *vcp,
 		return BT_ATT_ERROR_INVALID_CHANGE_COUNTER;
 	}
 
+	if (req->set_vol_offset > VOCS_VOL_OFFSET_UPPER_LIMIT ||
+		req->set_vol_offset < VOCS_VOL_OFFSET_LOWER_LIMIT) {
+		DBG(vcp, "error: Value Out of Range");
+		return BT_ATT_ERROR_VALUE_OUT_OF_RANGE;
+	}
 	vstate->vol_offset = req->set_vol_offset;
 	vstate->counter = -~vstate->counter; /*Increment Change Counter*/
 
@@ -971,7 +980,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
 							iov.iov_len);
 }
 
-static struct bt_vcs *vcs_new(struct gatt_db *db)
+static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
 {
 	struct bt_vcs *vcs;
 	struct vol_state *vstate;
@@ -990,6 +999,8 @@ static struct bt_vcs *vcs_new(struct gatt_db *db)
 	/* Populate DB with VCS attributes */
 	bt_uuid16_create(&uuid, VCS_UUID);
 	vcs->service = gatt_db_add_service(db, &uuid, true, 9);
+	gatt_db_service_add_included(vcs->service, vdb->vocs->service);
+	gatt_db_service_set_active(vdb->vocs->service, true);
 
 	bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
 	vcs->vs = gatt_db_service_add_characteristic(vcs->service,
@@ -1048,7 +1059,8 @@ static struct bt_vocs *vocs_new(struct gatt_db *db)
 
 	/* Populate DB with VOCS attributes */
 	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
-	vocs->service = gatt_db_add_service(db, &uuid, true, 9);
+
+	vocs->service = gatt_db_add_service(db, &uuid, false, 12);
 
 	bt_uuid16_create(&uuid, VOCS_STATE_CHAR_UUID);
 	vocs->vos = gatt_db_service_add_characteristic(vocs->service,
@@ -1110,11 +1122,10 @@ static struct bt_vcp_db *vcp_db_new(struct gatt_db *db)
 	if (!vcp_db)
 		vcp_db = queue_new();
 
-	vdb->vcs = vcs_new(db);
-	vdb->vcs->vdb = vdb;
-
 	vdb->vocs = vocs_new(db);
 	vdb->vocs->vdb = vdb;
+	vdb->vcs = vcs_new(db, vdb);
+	vdb->vcs->vdb = vdb;
 
 	queue_push_tail(vcp_db, vdb);
 
-- 
2.34.1

Re: [PATCH BlueZ v5 3/3] shared/vcp.c: Make VOCS as an included service of VCS

[Pauli Virtanen]

Hi,

ma, 2023-06-12 kello 19:02 +0530, Nitin Jadhav kirjoitti:
> Fixed the following issue observed during PTS testing
> - Specified Upper and Lower Limit for Volume offset
> - Corrected the number of handles for VOCS
> - VOCS is made as included service of VCS
>   (VOCS is secondary service and VSC is primary service)

I'm seeing a crash on BlueZ master branch
6b9d167034b741605c3186e78e9742dda8e28e08 with this patch, when trying
pair LE Audio TWS earbuds, with ControllerMode=le and experimental
features enabled in config and sound server with BAP support running.
It seems to crash reproducibly here during pairing. Also trying to
connect to previously paired BlueZ<->BlueZ seems to crash.

Reverting commit d2d2d12f59d65002c4a671a5af1837f295181142
("shared/vcp.c: Make VOCS as an included service of VCS") makes it to
not crash any more. Didn't try to look so far into detail if it's
directly related to this patch, but something in VCP might not be quite
right.

Logs:

bluetoothd[38339]: src/device.c:gatt_client_ready_cb() status: success, error: 0
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001800-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001801-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180a-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180f-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180f-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: a7a473e9-19c6-491b-aea6-7ea92b8f043a
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184f-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184e-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001850-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184d-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001844-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001855-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00008fe1-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001846-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001853-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/gap/gas.c:gap_probe() GAP profile probe (28:3D:C2:4A:7D:2A)
bluetoothd[38339]: src/service.c:change_state() 0x6040000409d0: device 28:3D:C2:4A:7D:2A profile gap-profile state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/gap/gas.c:gap_accept() GAP profile accept (28:3D:C2:4A:7D:2A)
bluetoothd[38339]: profiles/gap/gas.c:handle_characteristic() Unsupported characteristic: 00002aa6-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/service.c:change_state() 0x6040000409d0: device 28:3D:C2:4A:7D:2A profile gap-profile state changed: disconnected -> connected (0)
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/service.c:change_state() 0x604000040cd0: device 28:3D:C2:4A:7D:2A profile deviceinfo state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:deviceinfo_accept() deviceinfo profile accept (28:3D:C2:4A:7D:2A)
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a29-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a24-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a25-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a27-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a26-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a28-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a23-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a2a-0000-1000-8000-00805f9b34fb
bluetoothd[38339]: src/service.c:change_state() 0x604000040cd0: device 28:3D:C2:4A:7D:2A profile deviceinfo state changed: disconnected -> connected (0)
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/battery/battery.c:batt_probe() BATT profile probe (28:3D:C2:4A:7D:2A)
bluetoothd[38339]: src/service.c:change_state() 0x604000040e50: device 28:3D:C2:4A:7D:2A profile batt-profile state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/battery/battery.c:batt_accept() BATT profile accept (28:3D:C2:4A:7D:2A)
bluetoothd[38339]: profiles/battery/battery.c:foreach_batt_service() More than one BATT service exists for this device
bluetoothd[38339]: src/service.c:change_state() 0x604000040e50: device 28:3D:C2:4A:7D:2A profile batt-profile state changed: disconnected -> connected (0)
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/bass.c:bass_probe() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/gatt-database.c:gatt_db_service_added() GATT Service added to local database
bluetoothd[38339]: src/gatt-database.c:send_notification_to_device() GATT server sending indication
bluetoothd[38339]: src/gatt-database.c:db_hash_read_cb() Database Hash read
bluetoothd[38339]: profiles/audio/bass.c:bass_data_add() data 0x603000087b20
bluetoothd[38339]: src/service.c:change_state() 0x6040000410d0: device 28:3D:C2:4A:7D:2A profile bass state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/audio/bass.c:bass_accept() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/shared/bass.c:foreach_bass_char() Broadcast Audio Scan Control Point found: handle 0x003d
bluetoothd[38339]: src/shared/bass.c:foreach_bass_char() Broadcast Receive State found: handle 0x003f
bluetoothd[38339]: src/service.c:change_state() 0x6040000410d0: device 28:3D:C2:4A:7D:2A profile bass state changed: disconnected -> connected (0)
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/bap.c:bap_probe() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/bap.c:bap_data_add() data 0x60b000022fe0
bluetoothd[38339]: src/service.c:change_state() 0x604000042b10: device 28:3D:C2:4A:7D:2A profile bap state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/audio/bap.c:bap_accept() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/bap.c:bap_attached() 0x60e0000043a0
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() PAC Context found: handle 0x0050
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() PAC Supported Context found: handle 0x0053
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Sink PAC Location found: handle 0x0056
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Sink PAC found: handle 0x0059
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Source PAC Location found: handle 0x005c
bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Source PAC found: handle 0x005f
bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Control Point found: handle 0x0043
bluetoothd[38339]: src/shared/bap.c:bap_cp_attach() ASE CP handle 0x0043
bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Sink found: handle 0x0046
bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x0046
bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Sink found: handle 0x0049
bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x0049
bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Source found: handle 0x004c
bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x004c
bluetoothd[38339]: src/service.c:change_state() 0x604000042b10: device 28:3D:C2:4A:7D:2A profile bap state changed: disconnected -> connected (0)
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/vcp.c:vcp_probe() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: profiles/audio/vcp.c:vcp_data_add() data 0x60300008ab20
bluetoothd[38339]: src/service.c:change_state() 0x6040000432d0: device 28:3D:C2:4A:7D:2A profile vcp state changed: unavailable -> disconnected (0)
bluetoothd[38339]: profiles/audio/vcp.c:vcp_accept() 28:3D:C2:4A:7D:2A
bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Vol state found: handle 0x0024
bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Volume CP found: handle 0x0027
bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Vol Flag found: handle 0x0029
bluetoothd[38339]: =================================================================
bluetoothd[38339]: ==38339==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400003db08 at pc 0x0000006368fe bp 0x7ffd259cd910 sp 0x7ffd259cd908
bluetoothd[38339]: READ of size 8 at 0x60400003db08 thread T0
bluetoothd[38339]:     #0 0x6368fd in gatt_db_attribute_get_char_data src/shared/gatt-db.c:1877
bluetoothd[38339]:     #1 0x6135ac in notify_chrc_create src/shared/gatt-client.c:323
bluetoothd[38339]:     #2 0x61b275 in register_notify src/shared/gatt-client.c:1765
bluetoothd[38339]:     #3 0x624940 in bt_gatt_client_register_notify src/shared/gatt-client.c:3741
bluetoothd[38339]:     #4 0x66472e in vcp_register_notify src/shared/vcp.c:1517
bluetoothd[38339]:     #5 0x664eac in foreach_vcs_char src/shared/vcp.c:1586
bluetoothd[38339]:     #6 0x6351a2 in gatt_db_service_foreach src/shared/gatt-db.c:1524
bluetoothd[38339]:     #7 0x635234 in gatt_db_service_foreach_char src/shared/gatt-db.c:1532
bluetoothd[38339]:     #8 0x665993 in foreach_vcs_service src/shared/vcp.c:1686
bluetoothd[38339]:     #9 0x634452 in foreach_service_in_range src/shared/gatt-db.c:1413
bluetoothd[38339]:     #10 0x6347ba in foreach_in_range src/shared/gatt-db.c:1436
bluetoothd[38339]:     #11 0x5f7364 in queue_foreach src/shared/queue.c:207
bluetoothd[38339]:     #12 0x634d75 in gatt_db_foreach_service_in_range src/shared/gatt-db.c:1478
bluetoothd[38339]:     #13 0x634198 in gatt_db_foreach_service src/shared/gatt-db.c:1383
bluetoothd[38339]:     #14 0x665c15 in bt_vcp_attach src/shared/vcp.c:1722
bluetoothd[38339]:     #15 0x4b3ebc in vcp_accept profiles/audio/vcp.c:251
bluetoothd[38339]:     #16 0x561410 in service_accept src/service.c:203
bluetoothd[38339]:     #17 0x58275e in add_gatt_service src/device.c:3979
bluetoothd[38339]:     #18 0x634452 in foreach_service_in_range src/shared/gatt-db.c:1413
bluetoothd[38339]:     #19 0x6347ba in foreach_in_range src/shared/gatt-db.c:1436
bluetoothd[38339]:     #20 0x5f7364 in queue_foreach src/shared/queue.c:207
bluetoothd[38339]:     #21 0x634d75 in gatt_db_foreach_service_in_range src/shared/gatt-db.c:1478
bluetoothd[38339]:     #22 0x634198 in gatt_db_foreach_service src/shared/gatt-db.c:1383
bluetoothd[38339]:     #23 0x582929 in device_add_gatt_services src/device.c:3993
bluetoothd[38339]:     #24 0x58a590 in register_gatt_services src/device.c:5368
bluetoothd[38339]:     #25 0x58a6ad in gatt_client_ready_cb src/device.c:5386
bluetoothd[38339]:     #26 0x619375 in notify_client_ready src/shared/gatt-client.c:1390
bluetoothd[38339]:     #27 0x61cf29 in init_complete src/shared/gatt-client.c:2092
bluetoothd[38339]:     #28 0x614439 in discovery_op_complete src/shared/gatt-client.c:476
bluetoothd[38339]:     #29 0x619cec in db_hash_read_cb src/shared/gatt-client.c:1496
bluetoothd[38339]:     #30 0x673d37 in discovery_op_complete src/shared/gatt-helpers.c:615
bluetoothd[38339]:     #31 0x677336 in read_by_type_cb src/shared/gatt-helpers.c:1344
bluetoothd[38339]:     #32 0x60d878 in handle_rsp src/shared/att.c:860
bluetoothd[38339]:     #33 0x60e5cd in can_read_data src/shared/att.c:1052
bluetoothd[38339]:     #34 0x66f30e in watch_callback src/shared/io-glib.c:157
bluetoothd[38339]:     #35 0x7fdd0af8239b in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x5c39b) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #36 0x7fdd0afe0437 in g_main_context_iterate.isra.0 (/lib64/libglib-2.0.so.0+0xba437) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #37 0x7fdd0af8199e in g_main_loop_run (/lib64/libglib-2.0.so.0+0x5b99e) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #38 0x66fd29 in mainloop_run src/shared/mainloop-glib.c:66
bluetoothd[38339]:     #39 0x67077e in mainloop_run_with_signal src/shared/mainloop-notify.c:188
bluetoothd[38339]:     #40 0x4da138 in main src/main.c:1450
bluetoothd[38339]:     #41 0x7fdd0a649b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
bluetoothd[38339]:     #42 0x7fdd0a649c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
bluetoothd[38339]:     #43 0x40c974 in _start (/usr/local/stow/bluez-dev/libexec/bluetooth/bluetoothd+0x40c974) (BuildId: 339d83124c60413f66f5c84af62cd00e236e7733)
bluetoothd[38339]: 0x60400003db08 is located 8 bytes before 40-byte region [0x60400003db10,0x60400003db38)
bluetoothd[38339]: allocated by thread T0 here:
bluetoothd[38339]:     #0 0x7fdd0a8d92ff in malloc (/lib64/libasan.so.8+0xd92ff) (BuildId: dc689b05ca2577037af24700212bb5cce1f91c8a)
bluetoothd[38339]:     #1 0x5f86b7 in util_malloc src/shared/util.c:46
bluetoothd[38339]:     #2 0x62fe56 in gatt_db_service_create src/shared/gatt-db.c:533
bluetoothd[38339]:     #3 0x631171 in gatt_db_insert_service src/shared/gatt-db.c:734
bluetoothd[38339]:     #4 0x61844f in discovery_parse_services src/shared/gatt-client.c:1205
bluetoothd[38339]:     #5 0x618e8f in discover_primary_cb src/shared/gatt-client.c:1326
bluetoothd[38339]:     #6 0x673d37 in discovery_op_complete src/shared/gatt-helpers.c:615
bluetoothd[38339]:     #7 0x67432e in read_by_grp_type_cb src/shared/gatt-helpers.c:717
bluetoothd[38339]:     #8 0x60d878 in handle_rsp src/shared/att.c:860
bluetoothd[38339]:     #9 0x60e5cd in can_read_data src/shared/att.c:1052
bluetoothd[38339]:     #10 0x66f30e in watch_callback src/shared/io-glib.c:157
bluetoothd[38339]:     #11 0x7fdd0af8239b in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x5c39b) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #12 0x7fdd0afe0437 in g_main_context_iterate.isra.0 (/lib64/libglib-2.0.so.0+0xba437) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #13 0x7fdd0af8199e in g_main_loop_run (/lib64/libglib-2.0.so.0+0x5b99e) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
bluetoothd[38339]:     #14 0x66fd29 in mainloop_run src/shared/mainloop-glib.c:66
bluetoothd[38339]:     #15 0x67077e in mainloop_run_with_signal src/shared/mainloop-notify.c:188
bluetoothd[38339]:     #16 0x4da138 in main src/main.c:1450
bluetoothd[38339]:     #17 0x7fdd0a649b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
bluetoothd[38339]:     #18 0x7fdd0a649c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
bluetoothd[38339]:     #19 0x40c974 in _start (/usr/local/stow/bluez-dev/libexec/bluetooth/bluetoothd+0x40c974) (BuildId: 339d83124c60413f66f5c84af62cd00e236e7733)
bluetoothd[38339]: SUMMARY: AddressSanitizer: heap-buffer-overflow src/shared/gatt-db.c:1877 in gatt_db_attribute_get_char_data
bluetoothd[38339]: Shadow bytes around the buggy address:
bluetoothd[38339]:   0x60400003d880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
bluetoothd[38339]:   0x60400003d900: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003d980: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003da00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003da80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
bluetoothd[38339]: =>0x60400003db00: fa[fa]00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
bluetoothd[38339]:   0x60400003db80: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fa
bluetoothd[38339]:   0x60400003dc00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003dc80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003dd00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
bluetoothd[38339]:   0x60400003dd80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
bluetoothd[38339]: Shadow byte legend (one shadow byte represents 8 application bytes):
bluetoothd[38339]:   Addressable:           00
bluetoothd[38339]:   Partially addressable: 01 02 03 04 05 06 07
bluetoothd[38339]:   Heap left redzone:       fa
bluetoothd[38339]:   Freed heap region:       fd
bluetoothd[38339]:   Stack left redzone:      f1
bluetoothd[38339]:   Stack mid redzone:       f2
bluetoothd[38339]:   Stack right redzone:     f3
bluetoothd[38339]:   Stack after return:      f5
bluetoothd[38339]:   Stack use after scope:   f8
bluetoothd[38339]:   Global redzone:          f9
bluetoothd[38339]:   Global init order:       f6
bluetoothd[38339]:   Poisoned by user:        f7
bluetoothd[38339]:   Container overflow:      fc
bluetoothd[38339]:   Array cookie:            ac
bluetoothd[38339]:   Intra object redzone:    bb
bluetoothd[38339]:   ASan internal:           fe
bluetoothd[38339]:   Left alloca redzone:     ca
bluetoothd[38339]:   Right alloca redzone:    cb
bluetoothd[38339]: ==38339==ABORTING
systemd[1]: bluetooth.service: Main process exited, code=dumped, status=6/ABRT
systemd[1]: bluetooth.service: Failed with result 'core-dump'.


> ---
> v2: Cosmetic Changes (Bluez Test Bot)
> v5: Resolved GitLint warning (tedd_an/GitLint)
> ---
> 
>  src/shared/vcp.c | 25 ++++++++++++++++++-------
>  1 file changed, 18 insertions(+), 7 deletions(-)
> 
> diff --git a/src/shared/vcp.c b/src/shared/vcp.c
> index 92f21fd0b..74bd01729 100644
> --- a/src/shared/vcp.c
> +++ b/src/shared/vcp.c
> @@ -32,9 +32,13 @@
>  
>  #define VCP_STEP_SIZE 1
>  
> +#define VOCS_VOL_OFFSET_UPPER_LIMIT	 255
> +#define VOCS_VOL_OFFSET_LOWER_LIMIT	-255
> +
>  /* Apllication Error Code */
>  #define BT_ATT_ERROR_INVALID_CHANGE_COUNTER	0x80
>  #define BT_ATT_ERROR_OPCODE_NOT_SUPPORTED	0x81
> +#define BT_ATT_ERROR_VALUE_OUT_OF_RANGE		0x82
>  
>  #define BT_VCP_NA                   BIT(0)
>  #define BT_VCP_FRONT_LEFT           BIT(1)
> @@ -100,7 +104,7 @@ struct bt_vcs_ab_vol {
>  
>  struct bt_vocs_set_vol_off {
>  	uint8_t	change_counter;
> -	uint8_t	set_vol_offset;
> +	int16_t set_vol_offset;
>  } __packed;
>  
>  struct bt_vcp_cb {
> @@ -167,7 +171,7 @@ struct bt_vcs {
>  
>  /* Contains local bt_vcp_db */
>  struct vol_offset_state {
> -	uint16_t vol_offset;
> +	int16_t vol_offset;
>  	uint8_t counter;
>  } __packed;
>  
> @@ -705,6 +709,11 @@ static uint8_t vocs_set_vol_offset(struct bt_vocs *vocs, struct bt_vcp *vcp,
>  		return BT_ATT_ERROR_INVALID_CHANGE_COUNTER;
>  	}
>  
> +	if (req->set_vol_offset > VOCS_VOL_OFFSET_UPPER_LIMIT ||
> +		req->set_vol_offset < VOCS_VOL_OFFSET_LOWER_LIMIT) {
> +		DBG(vcp, "error: Value Out of Range");
> +		return BT_ATT_ERROR_VALUE_OUT_OF_RANGE;
> +	}
>  	vstate->vol_offset = req->set_vol_offset;
>  	vstate->counter = -~vstate->counter; /*Increment Change Counter*/
>  
> @@ -971,7 +980,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
>  							iov.iov_len);
>  }
>  
> -static struct bt_vcs *vcs_new(struct gatt_db *db)
> +static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
>  {
>  	struct bt_vcs *vcs;
>  	struct vol_state *vstate;
> @@ -990,6 +999,8 @@ static struct bt_vcs *vcs_new(struct gatt_db *db)
>  	/* Populate DB with VCS attributes */
>  	bt_uuid16_create(&uuid, VCS_UUID);
>  	vcs->service = gatt_db_add_service(db, &uuid, true, 9);
> +	gatt_db_service_add_included(vcs->service, vdb->vocs->service);
> +	gatt_db_service_set_active(vdb->vocs->service, true);
>  
>  	bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
>  	vcs->vs = gatt_db_service_add_characteristic(vcs->service,
> @@ -1048,7 +1059,8 @@ static struct bt_vocs *vocs_new(struct gatt_db *db)
>  
>  	/* Populate DB with VOCS attributes */
>  	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
> -	vocs->service = gatt_db_add_service(db, &uuid, true, 9);
> +
> +	vocs->service = gatt_db_add_service(db, &uuid, false, 12);
>  
>  	bt_uuid16_create(&uuid, VOCS_STATE_CHAR_UUID);
>  	vocs->vos = gatt_db_service_add_characteristic(vocs->service,
> @@ -1110,11 +1122,10 @@ static struct bt_vcp_db *vcp_db_new(struct gatt_db *db)
>  	if (!vcp_db)
>  		vcp_db = queue_new();
>  
> -	vdb->vcs = vcs_new(db);
> -	vdb->vcs->vdb = vdb;
> -
>  	vdb->vocs = vocs_new(db);
>  	vdb->vocs->vdb = vdb;
> +	vdb->vcs = vcs_new(db, vdb);
> +	vdb->vcs->vdb = vdb;
>  
>  	queue_push_tail(vcp_db, vdb);
>  

Re: [PATCH BlueZ v5 3/3] shared/vcp.c: Make VOCS as an included service of VCS

[Luiz Augusto von Dentz]

Hi Pauli, Nitin,

On Tue, Jun 27, 2023 at 12:05 PM Pauli Virtanen <pav@iki.fi> wrote:
>
> Hi,
>
> ma, 2023-06-12 kello 19:02 +0530, Nitin Jadhav kirjoitti:
> > Fixed the following issue observed during PTS testing
> > - Specified Upper and Lower Limit for Volume offset
> > - Corrected the number of handles for VOCS
> > - VOCS is made as included service of VCS
> >   (VOCS is secondary service and VSC is primary service)
>
> I'm seeing a crash on BlueZ master branch
> 6b9d167034b741605c3186e78e9742dda8e28e08 with this patch, when trying
> pair LE Audio TWS earbuds, with ControllerMode=le and experimental
> features enabled in config and sound server with BAP support running.
> It seems to crash reproducibly here during pairing. Also trying to
> connect to previously paired BlueZ<->BlueZ seems to crash.
>
> Reverting commit d2d2d12f59d65002c4a671a5af1837f295181142
> ("shared/vcp.c: Make VOCS as an included service of VCS") makes it to
> not crash any more. Didn't try to look so far into detail if it's
> directly related to this patch, but something in VCP might not be quite
> right.

Yep, Ive seem this as well, looks like we need to work on a unit
tester to avoid such regressions to be introduced, in the meantime Im
using -P vcp to exclude vcp for now.

> Logs:
>
> bluetoothd[38339]: src/device.c:gatt_client_ready_cb() status: success, error: 0
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001800-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001801-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180a-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180f-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000180f-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: a7a473e9-19c6-491b-aea6-7ea92b8f043a
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184f-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184e-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001850-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 0000184d-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001844-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001855-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00008fe1-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001846-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:update_gatt_uuids() UUID Added: 00001853-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/gap/gas.c:gap_probe() GAP profile probe (28:3D:C2:4A:7D:2A)
> bluetoothd[38339]: src/service.c:change_state() 0x6040000409d0: device 28:3D:C2:4A:7D:2A profile gap-profile state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/gap/gas.c:gap_accept() GAP profile accept (28:3D:C2:4A:7D:2A)
> bluetoothd[38339]: profiles/gap/gas.c:handle_characteristic() Unsupported characteristic: 00002aa6-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/service.c:change_state() 0x6040000409d0: device 28:3D:C2:4A:7D:2A profile gap-profile state changed: disconnected -> connected (0)
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/service.c:change_state() 0x604000040cd0: device 28:3D:C2:4A:7D:2A profile deviceinfo state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:deviceinfo_accept() deviceinfo profile accept (28:3D:C2:4A:7D:2A)
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a29-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a24-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a25-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a27-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a26-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a28-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a23-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: profiles/deviceinfo/deviceinfo.c:handle_characteristic() Unsupported characteristic: 00002a2a-0000-1000-8000-00805f9b34fb
> bluetoothd[38339]: src/service.c:change_state() 0x604000040cd0: device 28:3D:C2:4A:7D:2A profile deviceinfo state changed: disconnected -> connected (0)
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/battery/battery.c:batt_probe() BATT profile probe (28:3D:C2:4A:7D:2A)
> bluetoothd[38339]: src/service.c:change_state() 0x604000040e50: device 28:3D:C2:4A:7D:2A profile batt-profile state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/battery/battery.c:batt_accept() BATT profile accept (28:3D:C2:4A:7D:2A)
> bluetoothd[38339]: profiles/battery/battery.c:foreach_batt_service() More than one BATT service exists for this device
> bluetoothd[38339]: src/service.c:change_state() 0x604000040e50: device 28:3D:C2:4A:7D:2A profile batt-profile state changed: disconnected -> connected (0)
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/bass.c:bass_probe() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/gatt-database.c:gatt_db_service_added() GATT Service added to local database
> bluetoothd[38339]: src/gatt-database.c:send_notification_to_device() GATT server sending indication
> bluetoothd[38339]: src/gatt-database.c:db_hash_read_cb() Database Hash read
> bluetoothd[38339]: profiles/audio/bass.c:bass_data_add() data 0x603000087b20
> bluetoothd[38339]: src/service.c:change_state() 0x6040000410d0: device 28:3D:C2:4A:7D:2A profile bass state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/audio/bass.c:bass_accept() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/shared/bass.c:foreach_bass_char() Broadcast Audio Scan Control Point found: handle 0x003d
> bluetoothd[38339]: src/shared/bass.c:foreach_bass_char() Broadcast Receive State found: handle 0x003f
> bluetoothd[38339]: src/service.c:change_state() 0x6040000410d0: device 28:3D:C2:4A:7D:2A profile bass state changed: disconnected -> connected (0)
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/bap.c:bap_probe() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/bap.c:bap_data_add() data 0x60b000022fe0
> bluetoothd[38339]: src/service.c:change_state() 0x604000042b10: device 28:3D:C2:4A:7D:2A profile bap state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/audio/bap.c:bap_accept() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/bap.c:bap_attached() 0x60e0000043a0
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() PAC Context found: handle 0x0050
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() PAC Supported Context found: handle 0x0053
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Sink PAC Location found: handle 0x0056
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Sink PAC found: handle 0x0059
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Source PAC Location found: handle 0x005c
> bluetoothd[38339]: src/shared/bap.c:foreach_pacs_char() Source PAC found: handle 0x005f
> bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Control Point found: handle 0x0043
> bluetoothd[38339]: src/shared/bap.c:bap_cp_attach() ASE CP handle 0x0043
> bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Sink found: handle 0x0046
> bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x0046
> bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Sink found: handle 0x0049
> bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x0049
> bluetoothd[38339]: src/shared/bap.c:foreach_ascs_char() ASE Source found: handle 0x004c
> bluetoothd[38339]: src/shared/bap.c:bap_endpoint_attach() ASE handle 0x004c
> bluetoothd[38339]: src/service.c:change_state() 0x604000042b10: device 28:3D:C2:4A:7D:2A profile bap state changed: disconnected -> connected (0)
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/device.c:device_probe_profiles() Probing profiles for device 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/vcp.c:vcp_probe() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: profiles/audio/vcp.c:vcp_data_add() data 0x60300008ab20
> bluetoothd[38339]: src/service.c:change_state() 0x6040000432d0: device 28:3D:C2:4A:7D:2A profile vcp state changed: unavailable -> disconnected (0)
> bluetoothd[38339]: profiles/audio/vcp.c:vcp_accept() 28:3D:C2:4A:7D:2A
> bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Vol state found: handle 0x0024
> bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Volume CP found: handle 0x0027
> bluetoothd[38339]: src/shared/vcp.c:foreach_vcs_char() VCS Vol Flag found: handle 0x0029
> bluetoothd[38339]: =================================================================
> bluetoothd[38339]: ==38339==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400003db08 at pc 0x0000006368fe bp 0x7ffd259cd910 sp 0x7ffd259cd908
> bluetoothd[38339]: READ of size 8 at 0x60400003db08 thread T0
> bluetoothd[38339]:     #0 0x6368fd in gatt_db_attribute_get_char_data src/shared/gatt-db.c:1877
> bluetoothd[38339]:     #1 0x6135ac in notify_chrc_create src/shared/gatt-client.c:323
> bluetoothd[38339]:     #2 0x61b275 in register_notify src/shared/gatt-client.c:1765
> bluetoothd[38339]:     #3 0x624940 in bt_gatt_client_register_notify src/shared/gatt-client.c:3741
> bluetoothd[38339]:     #4 0x66472e in vcp_register_notify src/shared/vcp.c:1517
> bluetoothd[38339]:     #5 0x664eac in foreach_vcs_char src/shared/vcp.c:1586
> bluetoothd[38339]:     #6 0x6351a2 in gatt_db_service_foreach src/shared/gatt-db.c:1524
> bluetoothd[38339]:     #7 0x635234 in gatt_db_service_foreach_char src/shared/gatt-db.c:1532
> bluetoothd[38339]:     #8 0x665993 in foreach_vcs_service src/shared/vcp.c:1686
> bluetoothd[38339]:     #9 0x634452 in foreach_service_in_range src/shared/gatt-db.c:1413
> bluetoothd[38339]:     #10 0x6347ba in foreach_in_range src/shared/gatt-db.c:1436
> bluetoothd[38339]:     #11 0x5f7364 in queue_foreach src/shared/queue.c:207
> bluetoothd[38339]:     #12 0x634d75 in gatt_db_foreach_service_in_range src/shared/gatt-db.c:1478
> bluetoothd[38339]:     #13 0x634198 in gatt_db_foreach_service src/shared/gatt-db.c:1383
> bluetoothd[38339]:     #14 0x665c15 in bt_vcp_attach src/shared/vcp.c:1722
> bluetoothd[38339]:     #15 0x4b3ebc in vcp_accept profiles/audio/vcp.c:251
> bluetoothd[38339]:     #16 0x561410 in service_accept src/service.c:203
> bluetoothd[38339]:     #17 0x58275e in add_gatt_service src/device.c:3979
> bluetoothd[38339]:     #18 0x634452 in foreach_service_in_range src/shared/gatt-db.c:1413
> bluetoothd[38339]:     #19 0x6347ba in foreach_in_range src/shared/gatt-db.c:1436
> bluetoothd[38339]:     #20 0x5f7364 in queue_foreach src/shared/queue.c:207
> bluetoothd[38339]:     #21 0x634d75 in gatt_db_foreach_service_in_range src/shared/gatt-db.c:1478
> bluetoothd[38339]:     #22 0x634198 in gatt_db_foreach_service src/shared/gatt-db.c:1383
> bluetoothd[38339]:     #23 0x582929 in device_add_gatt_services src/device.c:3993
> bluetoothd[38339]:     #24 0x58a590 in register_gatt_services src/device.c:5368
> bluetoothd[38339]:     #25 0x58a6ad in gatt_client_ready_cb src/device.c:5386
> bluetoothd[38339]:     #26 0x619375 in notify_client_ready src/shared/gatt-client.c:1390
> bluetoothd[38339]:     #27 0x61cf29 in init_complete src/shared/gatt-client.c:2092
> bluetoothd[38339]:     #28 0x614439 in discovery_op_complete src/shared/gatt-client.c:476
> bluetoothd[38339]:     #29 0x619cec in db_hash_read_cb src/shared/gatt-client.c:1496
> bluetoothd[38339]:     #30 0x673d37 in discovery_op_complete src/shared/gatt-helpers.c:615
> bluetoothd[38339]:     #31 0x677336 in read_by_type_cb src/shared/gatt-helpers.c:1344
> bluetoothd[38339]:     #32 0x60d878 in handle_rsp src/shared/att.c:860
> bluetoothd[38339]:     #33 0x60e5cd in can_read_data src/shared/att.c:1052
> bluetoothd[38339]:     #34 0x66f30e in watch_callback src/shared/io-glib.c:157
> bluetoothd[38339]:     #35 0x7fdd0af8239b in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x5c39b) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #36 0x7fdd0afe0437 in g_main_context_iterate.isra.0 (/lib64/libglib-2.0.so.0+0xba437) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #37 0x7fdd0af8199e in g_main_loop_run (/lib64/libglib-2.0.so.0+0x5b99e) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #38 0x66fd29 in mainloop_run src/shared/mainloop-glib.c:66
> bluetoothd[38339]:     #39 0x67077e in mainloop_run_with_signal src/shared/mainloop-notify.c:188
> bluetoothd[38339]:     #40 0x4da138 in main src/main.c:1450
> bluetoothd[38339]:     #41 0x7fdd0a649b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
> bluetoothd[38339]:     #42 0x7fdd0a649c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
> bluetoothd[38339]:     #43 0x40c974 in _start (/usr/local/stow/bluez-dev/libexec/bluetooth/bluetoothd+0x40c974) (BuildId: 339d83124c60413f66f5c84af62cd00e236e7733)
> bluetoothd[38339]: 0x60400003db08 is located 8 bytes before 40-byte region [0x60400003db10,0x60400003db38)
> bluetoothd[38339]: allocated by thread T0 here:
> bluetoothd[38339]:     #0 0x7fdd0a8d92ff in malloc (/lib64/libasan.so.8+0xd92ff) (BuildId: dc689b05ca2577037af24700212bb5cce1f91c8a)
> bluetoothd[38339]:     #1 0x5f86b7 in util_malloc src/shared/util.c:46
> bluetoothd[38339]:     #2 0x62fe56 in gatt_db_service_create src/shared/gatt-db.c:533
> bluetoothd[38339]:     #3 0x631171 in gatt_db_insert_service src/shared/gatt-db.c:734
> bluetoothd[38339]:     #4 0x61844f in discovery_parse_services src/shared/gatt-client.c:1205
> bluetoothd[38339]:     #5 0x618e8f in discover_primary_cb src/shared/gatt-client.c:1326
> bluetoothd[38339]:     #6 0x673d37 in discovery_op_complete src/shared/gatt-helpers.c:615
> bluetoothd[38339]:     #7 0x67432e in read_by_grp_type_cb src/shared/gatt-helpers.c:717
> bluetoothd[38339]:     #8 0x60d878 in handle_rsp src/shared/att.c:860
> bluetoothd[38339]:     #9 0x60e5cd in can_read_data src/shared/att.c:1052
> bluetoothd[38339]:     #10 0x66f30e in watch_callback src/shared/io-glib.c:157
> bluetoothd[38339]:     #11 0x7fdd0af8239b in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x5c39b) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #12 0x7fdd0afe0437 in g_main_context_iterate.isra.0 (/lib64/libglib-2.0.so.0+0xba437) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #13 0x7fdd0af8199e in g_main_loop_run (/lib64/libglib-2.0.so.0+0x5b99e) (BuildId: b0e6a618cd46494b058c5f00ce2f1a650b200ce3)
> bluetoothd[38339]:     #14 0x66fd29 in mainloop_run src/shared/mainloop-glib.c:66
> bluetoothd[38339]:     #15 0x67077e in mainloop_run_with_signal src/shared/mainloop-notify.c:188
> bluetoothd[38339]:     #16 0x4da138 in main src/main.c:1450
> bluetoothd[38339]:     #17 0x7fdd0a649b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
> bluetoothd[38339]:     #18 0x7fdd0a649c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
> bluetoothd[38339]:     #19 0x40c974 in _start (/usr/local/stow/bluez-dev/libexec/bluetooth/bluetoothd+0x40c974) (BuildId: 339d83124c60413f66f5c84af62cd00e236e7733)
> bluetoothd[38339]: SUMMARY: AddressSanitizer: heap-buffer-overflow src/shared/gatt-db.c:1877 in gatt_db_attribute_get_char_data
> bluetoothd[38339]: Shadow bytes around the buggy address:
> bluetoothd[38339]:   0x60400003d880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
> bluetoothd[38339]:   0x60400003d900: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003d980: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003da00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003da80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
> bluetoothd[38339]: =>0x60400003db00: fa[fa]00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
> bluetoothd[38339]:   0x60400003db80: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fa
> bluetoothd[38339]:   0x60400003dc00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003dc80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003dd00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
> bluetoothd[38339]:   0x60400003dd80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
> bluetoothd[38339]: Shadow byte legend (one shadow byte represents 8 application bytes):
> bluetoothd[38339]:   Addressable:           00
> bluetoothd[38339]:   Partially addressable: 01 02 03 04 05 06 07
> bluetoothd[38339]:   Heap left redzone:       fa
> bluetoothd[38339]:   Freed heap region:       fd
> bluetoothd[38339]:   Stack left redzone:      f1
> bluetoothd[38339]:   Stack mid redzone:       f2
> bluetoothd[38339]:   Stack right redzone:     f3
> bluetoothd[38339]:   Stack after return:      f5
> bluetoothd[38339]:   Stack use after scope:   f8
> bluetoothd[38339]:   Global redzone:          f9
> bluetoothd[38339]:   Global init order:       f6
> bluetoothd[38339]:   Poisoned by user:        f7
> bluetoothd[38339]:   Container overflow:      fc
> bluetoothd[38339]:   Array cookie:            ac
> bluetoothd[38339]:   Intra object redzone:    bb
> bluetoothd[38339]:   ASan internal:           fe
> bluetoothd[38339]:   Left alloca redzone:     ca
> bluetoothd[38339]:   Right alloca redzone:    cb
> bluetoothd[38339]: ==38339==ABORTING
> systemd[1]: bluetooth.service: Main process exited, code=dumped, status=6/ABRT
> systemd[1]: bluetooth.service: Failed with result 'core-dump'.
>
>
> > ---
> > v2: Cosmetic Changes (Bluez Test Bot)
> > v5: Resolved GitLint warning (tedd_an/GitLint)
> > ---
> >
> >  src/shared/vcp.c | 25 ++++++++++++++++++-------
> >  1 file changed, 18 insertions(+), 7 deletions(-)
> >
> > diff --git a/src/shared/vcp.c b/src/shared/vcp.c
> > index 92f21fd0b..74bd01729 100644
> > --- a/src/shared/vcp.c
> > +++ b/src/shared/vcp.c
> > @@ -32,9 +32,13 @@
> >
> >  #define VCP_STEP_SIZE 1
> >
> > +#define VOCS_VOL_OFFSET_UPPER_LIMIT   255
> > +#define VOCS_VOL_OFFSET_LOWER_LIMIT  -255
> > +
> >  /* Apllication Error Code */
> >  #define BT_ATT_ERROR_INVALID_CHANGE_COUNTER  0x80
> >  #define BT_ATT_ERROR_OPCODE_NOT_SUPPORTED    0x81
> > +#define BT_ATT_ERROR_VALUE_OUT_OF_RANGE              0x82
> >
> >  #define BT_VCP_NA                   BIT(0)
> >  #define BT_VCP_FRONT_LEFT           BIT(1)
> > @@ -100,7 +104,7 @@ struct bt_vcs_ab_vol {
> >
> >  struct bt_vocs_set_vol_off {
> >       uint8_t change_counter;
> > -     uint8_t set_vol_offset;
> > +     int16_t set_vol_offset;
> >  } __packed;
> >
> >  struct bt_vcp_cb {
> > @@ -167,7 +171,7 @@ struct bt_vcs {
> >
> >  /* Contains local bt_vcp_db */
> >  struct vol_offset_state {
> > -     uint16_t vol_offset;
> > +     int16_t vol_offset;
> >       uint8_t counter;
> >  } __packed;
> >
> > @@ -705,6 +709,11 @@ static uint8_t vocs_set_vol_offset(struct bt_vocs *vocs, struct bt_vcp *vcp,
> >               return BT_ATT_ERROR_INVALID_CHANGE_COUNTER;
> >       }
> >
> > +     if (req->set_vol_offset > VOCS_VOL_OFFSET_UPPER_LIMIT ||
> > +             req->set_vol_offset < VOCS_VOL_OFFSET_LOWER_LIMIT) {
> > +             DBG(vcp, "error: Value Out of Range");
> > +             return BT_ATT_ERROR_VALUE_OUT_OF_RANGE;
> > +     }
> >       vstate->vol_offset = req->set_vol_offset;
> >       vstate->counter = -~vstate->counter; /*Increment Change Counter*/
> >
> > @@ -971,7 +980,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
> >                                                       iov.iov_len);
> >  }
> >
> > -static struct bt_vcs *vcs_new(struct gatt_db *db)
> > +static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
> >  {
> >       struct bt_vcs *vcs;
> >       struct vol_state *vstate;
> > @@ -990,6 +999,8 @@ static struct bt_vcs *vcs_new(struct gatt_db *db)
> >       /* Populate DB with VCS attributes */
> >       bt_uuid16_create(&uuid, VCS_UUID);
> >       vcs->service = gatt_db_add_service(db, &uuid, true, 9);
> > +     gatt_db_service_add_included(vcs->service, vdb->vocs->service);
> > +     gatt_db_service_set_active(vdb->vocs->service, true);
> >
> >       bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
> >       vcs->vs = gatt_db_service_add_characteristic(vcs->service,
> > @@ -1048,7 +1059,8 @@ static struct bt_vocs *vocs_new(struct gatt_db *db)
> >
> >       /* Populate DB with VOCS attributes */
> >       bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
> > -     vocs->service = gatt_db_add_service(db, &uuid, true, 9);
> > +
> > +     vocs->service = gatt_db_add_service(db, &uuid, false, 12);
> >
> >       bt_uuid16_create(&uuid, VOCS_STATE_CHAR_UUID);
> >       vocs->vos = gatt_db_service_add_characteristic(vocs->service,
> > @@ -1110,11 +1122,10 @@ static struct bt_vcp_db *vcp_db_new(struct gatt_db *db)
> >       if (!vcp_db)
> >               vcp_db = queue_new();
> >
> > -     vdb->vcs = vcs_new(db);
> > -     vdb->vcs->vdb = vdb;
> > -
> >       vdb->vocs = vocs_new(db);
> >       vdb->vocs->vdb = vdb;
> > +     vdb->vcs = vcs_new(db, vdb);
> > +     vdb->vcs->vdb = vdb;
> >
> >       queue_push_tail(vcp_db, vdb);
> >
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ v5 0/3] Code handling for VOCS service

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 12 Jun 2023 19:02:48 +0530 you wrote:
> Hello Maintainers
> 
> This patch series handles code implementation for mandatory features of Volume Offset Control Service.
> 
> Implementation of following features have been handled in this patch series
> - Volume Offset Control Service
> - Volume Offset State Characteristic (Read, Notify)
> - Audio Location Characteristic (Read)
> - Volume Offset Control Point Characteristic (Write)
> - Audio Output Description Characteristic (Read)
> - Set Volume Offset
> 
> [...]

Here is the summary with links:
  - [BlueZ,v5,1/3] lib/uuid.h: Add VOCS characteristic uuid(s)
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=0735ca179fdf
  - [BlueZ,v5,2/3] shared/vcp: Add initial code for handling VOCS
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=52a4d79f22c3
  - [BlueZ,v5,3/3] shared/vcp.c: Make VOCS as an included service of VCS
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d2d2d12f59d6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html