Merge branch 'develop'

# Conflicts:
#	README.md

.gitignore

@@ -22,3 +22,4 @@ TIInit_11.8.32.c
 initscripts_TIInit_6.7.16_bt_spec_4.1.c
 *.jdebug
 *.jdebug.user
+cmake-build-*

3rd-party/README.md

@@ -9,6 +9,7 @@ Library
 [lwIP](http://savannah.nongnu.org/projects/lwip/)                                                               | b3a93941 | BSD 3-Clause  | PAN Demo         | complete network stack
 [md5](http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5)                            |      1.0 | Public Domain | PBAP             | cryptographic hash function
 [micro-ecc](https://github.com/kmackay/micro-ecc)                                                               | e4d264b5 | BSD 2-Clause  | LE SC, Mesh      | elliptic curve library
+[Rijndael Encryption Algorithm](http://www.efgh.com/software/rijndael.htm)                                      | 20020903 | Public Domain | BTstack Crypto   | optional AES128 software implementation  
 [segger-rtt](https://www.segger.com/products/debug-probes/j-link/technology/about-real-time-transfer/)          |   v6.20d | BSD 3-Clause  | HCI PacketLog    | high-speed logging with SEGGER J-Link debug probes (development)
 [tinydir](https://github.com/cxong/tinydir)                                                                     | 677733da | BSD 2-Clause  | GAP Bonding      | get a directory listing on POSIX + Windwows systems
 [Yxml](https://dev.yorhel.nl/yxml)                                                                              | 10f968b0 | MIT           | PBAP             | minimal stream XML parser

3rd-party/micro-ecc/uECC.c

@@ -368,7 +368,7 @@ typedef struct EccPoint {
 } EccPoint;
 
 static const uECC_word_t curve_p[uECC_WORDS] = uECC_CONCAT(Curve_P_, uECC_CURVE);
-static const uECC_word_t curve_b[uECC_WORDS] = uECC_CONCAT(Curve_B_, uECC_CURVE);
+// Global object `curve_b' is only referenced from function `curve_x_side', it should be defined within that functions block scope
 static const EccPoint curve_G = uECC_CONCAT(Curve_G_, uECC_CURVE);
 static const uECC_word_t curve_n[uECC_N_WORDS] = uECC_CONCAT(Curve_N_, uECC_CURVE);
 
@@ -2083,6 +2083,7 @@ void uECC_compress(const uint8_t public_key[uECC_BYTES*2], uint8_t compressed[uE
 
 /* Computes result = x^3 + ax + b. result must not overlap x. */
 static void curve_x_side(uECC_word_t * RESTRICT result, const uECC_word_t * RESTRICT x) {
+    static const uECC_word_t curve_b[uECC_WORDS] = uECC_CONCAT(Curve_B_, uECC_CURVE);
 #if (uECC_CURVE == uECC_secp256k1)
     vli_modSquare_fast(result, x); /* r = x^2 */
     vli_modMult_fast(result, result, x); /* r = x^3 */

3rd-party/segger-rtt/SEGGER_RTT_Conf.h

@@ -82,7 +82,7 @@ Revision: $Rev: 15929 $
 
 #define SEGGER_RTT_PRINTF_BUFFER_SIZE             (64u)    // Size of buffer for RTT printf to bulk-send chars via RTT     (Default: 64)
 
-#define SEGGER_RTT_MODE_DEFAULT                   SEGGER_RTT_MODE_NO_BLOCK_SKIP // Mode for pre-initialized terminal channel (buffer 0)
+#define SEGGER_RTT_MODE_DEFAULT                   SEGGER_RTT_MODE_BLOCK_IF_FIFO_FULL // Mode for pre-initialized terminal channel (buffer 0)
 
 /*********************************************************************
 *

CHANGELOG.md

@@ -8,14 +8,48 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Fixed
+
+### Added
+
+### Changed
+
+## Changes Februar 2020
+
+### Fixed
+- AVRCP Target: fix reporting of PLAYBACK_STATUS_CHANGED
+
+### Changed
+- hid_host_mode: allow sniff mode
+
+## Changes January 2020
+
+### Fixed
+- L2CAP ERTM: avoid read-after-free on decline of incoming connection
+- GATT Client: set uuid16 to zero when deserializing uuid128 services, characteristics, and descriptors
+- att_db_util: fix realloc of att db buffer for large attributes
+- btstack_tlv_posix: only keep last value in memory, fix delete operation
+- l2cap_signaling: use packet boundary flags 0x00 for LE signaling packets (ignoring hci_non_flushable_packet_boundary_flag_supported())
+
+### Added
+- att_db_util: provide GATT Database Hash via att_db_util_hash_calc
+- GATT Compiler: provide GATT Database Hash via GATT_DATABASE_HASH Characteristic
+- ATT Server: validate request pdu length
+
+### Changed
+- btstack_crypto: update AES-CMAC implementation to access all message bytes sequentially
+
+## Changes December 2019
+
 ### Fixed
 - example/pan_lwip_http_server: use Network Access Point, CoD
+- sm: emit pairing complete in master role when no keys are distributed / bonding disabled
 
 ### Added
 
 ### Changed
 - Updated CC256x initscript: CC256xC v1.3
-
+- ESP32: add CMake project files
 
 ## Changes November 2019
 

README.md

@@ -33,8 +33,8 @@ BTstack is free for non-commercial use. However, for commercial use, <a href="ma
 
 **In Development:** BLE Mesh and more.
 
-It has been qualified with the Bluetooth SIG (QDID 110883) for GAP, IOP, HFP, HSP, SPP, PAN, A2DP, AVRCP profiles and
-GATT, SM of the Bluetooth 5 specification. For information on MFi/iAP2 support, please <a href="mailto:contact@bluekitchen-gmbh.com">contact us</a>.
+It has been qualified with the Bluetooth SIG (QDID 110883) for GAP 1.1, IOP, HFP 1.7, HSP 1.2, SPP 1.2, PAN 1.0, A2DP 1.3, AVRCP 1.6 profiles and
+GATT, SM of the Bluetooth Core 5.0 specification. For information on MFi/iAP2 support, please <a href="mailto:contact@bluekitchen-gmbh.com">contact us</a>.
 
 ## Evaluation Platforms
 
@@ -50,6 +50,7 @@ Build Status               | Port | Platform
 [<img src="http://buildbot.bluekitchen-gmbh.com/btstack/badges/port-stm32-f103rb-nucleo-master.svg">](https://buildbot.bluekitchen-gmbh.com/btstack/#/builders/port-stm32-f103rb-nucleo-master)       | [stm32-f103rb-nucleo](https://github.com/bluekitchen/btstack/tree/master/port/stm32-f103rb-nucleo) | [STM32 Nucleo development board NUCLEO-F103RB](http://www.st.com/web/catalog/tools/FM116/SC959/SS1532/LN1847/PF259875) with [Bluetooth CC2564 Module Evaluation Board](http://www.ti.com/tool/cc2564modnem) and [EM Adapter BoosterPack](http://www.ti.com/tool/boost-ccemadapter) with additional 32768Hz quartz oscillator
 [<img src="http://buildbot.bluekitchen-gmbh.com/btstack/badges/port-stm32-f4discovery-cc256x-master.svg">](https://buildbot.bluekitchen-gmbh.com/btstack/#/builders/port-stm32-f4discovery-cc256x-master) | [stm32-f4discovery-cc2564b](https://github.com/bluekitchen/btstack/tree/master/port/stm32-f4discovery-cc256x) | [STM32 F4 Discovery Board](http://www.st.com/en/evaluation-tools/stm32f4discovery.html) with [CC256xEM Bluetooth Adapter Kit for ST](https://store.ti.com/CC256XEM-STADAPT-CC256xEM-Bluetooth-Adapter-Kit-P45158.aspx) and [CC2564B Dual-mode Bluetooth® Controller Evaluation Module](https://store.ti.com/cc2564modnem.aspx)
 [<img src="http://buildbot.bluekitchen-gmbh.com/btstack/badges/port-stm32-l073rz-nucleo-em9304-master.svg">](https://buildbot.bluekitchen-gmbh.com/btstack/#/builders/port-stm32-l073rz-nucleo-em9304)  | [stm32-l073rz-nucleo-em9304](https://github.com/bluekitchen/btstack/tree/master/port/stm32-l073rz-nucleo-em9304) | EM9304 DVK: [STM32 Nucleo development board NUCELO-L73RZ](https://www.st.com/en/evaluation-tools/nucleo-l073rz.html) with [EM9304  Bluetooth Controller](http://www.emmicroelectronic.com/products/wireless-rf/standard-protocols/em9304)
+No build server | [stm32-wb55xx-nucleo-freertos](https://github.com/bluekitchen/btstack/tree/master/port/stm32-wb55xx-nucleo-freertos) | [P-NUCLEO-WB55 kit](https://www.st.com/en/evaluation-tools/p-nucleo-wb55.html)
 [<img src="http://buildbot.bluekitchen-gmbh.com/btstack/badges/port-pic32-harmony-master.svg">](https://buildbot.bluekitchen-gmbh.com/btstack/#/builders/port-pic32-harmony-master)                |  [pic32-harmony](https://github.com/bluekitchen/btstack/tree/master/port/pic32-harmony)  | [Microchip's PIC32 Bluetooth Audio Development Kit](http://www.microchip.com/Developmenttools/ProductDetails.aspx?PartNO=DV320032)
 [<img src="http://buildbot.bluekitchen-gmbh.com/btstack/badges/port-wiced-h4-master.svg">](https://buildbot.bluekitchen-gmbh.com/btstack/#/builders/port-wiced-h4-master)                           | [wiced-h4](https://github.com/bluekitchen/btstack/tree/master/port/wiced-h4) | Broadcom/Cypress platforms that support the WICED SDK via H4 UART, e.g. [RedBear Duo](https://redbear.cc/product/wifi-ble/redbear-duo.html) (BCM43438 A1), [Inventek Systems ISM4334x](https://www.inventeksys.com/wifi/wifi-modules/ism4343-wmb-l151/) (BCM43438 A1), [Inventek Systems ISM4343](https://www.inventeksys.com/products-page/wifi-modules/serial-wifi/ism43341-m4g-l44-cu-embedded-serial-to-wifi-ble-nfc-module/) (BCM43340)
 No build server | [wiced-h5](https://github.com/bluekitchen/btstack/tree/master/port/wiced-h5) | Broadcom platforms that support the WICED SDK via H5 UART, see wiced-h4
@@ -93,6 +94,7 @@ EM 9301, 9304                | LE        | SPI             | n.a.             |
 Intel Dual Wireless 8260, 8265 | Dual mode | USB           | Probably         | intel          | Firmware size: 400 kB 
 Nordic nRF                   | LE        | H4              | n.a.             |                | Requires custom HCI firmware
 STM STLC2500D                | Classic   | H4              | No (didn't try)  | stlc2500d      | Custom deep sleep management not supported
+STM32-WB5x                   | LE        | VHCI            | n.a.             |                | SoC with multi-protocol Radio co-processor
 Toshiba TC35661              | Dual mode | H4              | No               | tc3566         |
 TI CC256x, WL183x            | Dual mode | H4, H5, eHCILL  | Yes              | cc256x         | Also WL185x, WL187x, and WL189x
 

chipset/README.md

@@ -70,6 +70,7 @@ EM 9304              | LE        | SPI, H4        | Yes          | n.a.
 Intel Dual Wireless 8260, 8265 | Dual mode | USB  | Yes          | Probably         | Don't know | Don't know       | intel          | Firmware size: 400 kB 
 Nordic nRF           | LE        | H4             | Fixed Random | n.a.             | Yes    |        Yes           |                | Requires HCI firmware
 STM STLC2500D        | Classic   | H4             | No           | Don't know       | n.a    |         n.a.         | stlc2500d      | Custom deep sleep management not supported
+STM32-WB5x           | LE        | VHCI           | ?            | n.a.             | Yes    |        Yes           |                | SoC with multi-protocol radio co-processor 
 Toshiba TC35661      | Dual mode | H4             | No           | No               | No     |         No           | tc3566         | Only -007/009 models provide full HCI. See below
 TI CC256x, WL183x    | Dual mode | H4, H5, eHCILL | Yes          | Yes              | No     |    Yes for CC256XC   | cc256x         | Also WL185x, WL187x, and WL189x
 
@@ -166,8 +167,6 @@ The even newer DA1469x uses an external flash. The DA 1469x SDK contains a HCI f
 
 The ESP32 is a SoC with a built-in Dual mode Bluetooth and Wifi radio. The HCI Controller is implemented in software and accessed via a so called Virtual HCI (VHCI) interface. It supports both LE Data Length Extensions (DLE) as well as multiple LE roles. SCO isn't supported currently, but [Espressif is working on it](https://github.com/espressif/esp-idf/issues/1118).
 
-Bluetooth/Wifi Co-existance didn't work until recently and [seems to have been fixed](https://github.com/espressif/esp-idf/issues/1291)
-
 ## EM Microelectronic Marin
 
 For a long time, the EM9301 has been the only Bluetooth Single-Mode LE chipset with an HCI interface. The EM9301 can be connected via SPI or UART. The UART interface does not support hardware flow control and is not recommended for use with BTstack. The SPI mode uses a proprietary but documented extension to implement flow control and signal if the EM9301 has data to send.
@@ -241,7 +240,7 @@ STMicroelectronics offers the Bluetooth V2.1 + EDR chipset STLC2500D that suppor
 
 **BTstack integration**: Support for the STLC2500C is provided by *btstack_chipset_stlc.c*. During the setup, *btstack_chipset_stlc2500d_instance* function is used to get a *btstack_chipset_t* instance and passed to *hci_init* function. It enables higher UART baud rate and to set the BD Addr during startup.
 
-
+The new STM32-WB5x series microcontroller is an SoC with a multi-protocol 2.4 Ghz radio co-processor. It provides a virtual HCI interface.
 
 ## Texas Instruments CC256x series
 

doc/manual/docs/profiles.md

@@ -563,3 +563,29 @@ In addition to the attribute value handle, the handle for the Client Characteris
 Finally, in order to send Notifications and Indications independently from the main application, *att_server_register_can_send_now_callback* can be used to request a callback when it's possible to send a Notification or Indication.
 
 To see how this works together, please check out the Battery Service Server in *src/ble/battery_service_server.c*.
+
+### GATT Database Hash
+
+When a GATT Client connects to a GATT Server, it cannot know if the GATT Database has changed 
+and has to discover the provided GATT Services and Characteristics after each connect.
+
+To speed this up, the Bluetooth
+specification defines a GATT Service Changed Characteristic, with the idea that a GATT Server would notify
+a bonded GATT Client if its database changed. However, this is quite fragile and it is not clear how it can be implemented
+in a robust way.
+
+The Bluetooth Core Spec 5.1 introduced the GATT Database Hash Characteristic, which allows for a simple 
+robust mechanism to cache a remote GATT Database. The GATT Database Hash is a 16-byte value that is calculated
+over the list of Services and Characteristics. If there is any change to the database, the hash will change as well.
+
+To support this on the GATT Server, you only need to add a GATT Service with the GATT Database Characteristic to your .gatt file.
+The hash value is then calculated by the GATT compiler. 
+
+
+    PRIMARY_SERVICE, GATT_SERVICE
+    CHARACTERISTIC, GATT_DATABASE_HASH, READ,
+
+Note: make sure to install the PyCryptodome python package as the hash is calculated using AES-CMAC,
+e.g. with:
+
+    pip install pycryptodomex

example/Makefile.inc

@@ -138,9 +138,11 @@ MESH = \
 	gatt_bearer.c \
 	mesh.c \
 	mesh_access.c \
+	mesh_configuration_client.c \
 	mesh_configuration_server.c \
 	mesh_crypto.c \
 	mesh_foundation.c \
+	mesh_generic_default_transition_time_client.c \
 	mesh_generic_default_transition_time_server.c \
 	mesh_generic_level_client.c \
 	mesh_generic_level_server.c \

example/a2dp_source_demo.c

@@ -88,6 +88,7 @@ typedef enum {
 typedef struct {
     uint16_t a2dp_cid;
     uint8_t  local_seid;
+    uint8_t  remote_seid;
     uint8_t  stream_opened;
     uint16_t avrcp_cid;
 
@@ -167,6 +168,7 @@ static const char * device_addr_string = "00:21:3C:AC:F7:38";
 // BT dongle:       static const char * device_addr_string = "00:1A:7D:DA:71:0A";
 // Sony MDR-ZX330BT static const char * device_addr_string = "00:18:09:28:50:18";
 // Panda (BM6)      static const char * device_addr_string = "4F:3F:66:52:8B:E0";
+// BeatsX:          static const char * device_addr_string = "DC:D3:A2:89:57:FB";
 
 static bd_addr_t device_addr;
 static uint8_t sdp_a2dp_source_service_buffer[150];
@@ -276,6 +278,9 @@ static void a2dp_demo_reconfigure_sample_rate(int new_sample_rate){
 
 static int a2dp_source_and_avrcp_services_init(void){
 
+    // request role change on reconnecting headset to always use them in slave mode
+    hci_set_master_slave_policy(0);
+
     l2cap_init();
     // Initialize  A2DP Source.
     a2dp_source_init();
@@ -543,6 +548,7 @@ static void a2dp_source_packet_handler(uint8_t packet_type, uint16_t channel, ui
          case A2DP_SUBEVENT_SIGNALING_MEDIA_CODEC_SBC_CONFIGURATION:{
             cid  = avdtp_subevent_signaling_media_codec_sbc_configuration_get_avdtp_cid(packet);
             if (cid != media_tracker.a2dp_cid) return;
+            media_tracker.remote_seid = a2dp_subevent_signaling_media_codec_sbc_configuration_get_acp_seid(packet);
 
             sbc_configuration.reconfigure = a2dp_subevent_signaling_media_codec_sbc_configuration_get_reconfigure(packet);
             sbc_configuration.num_channels = a2dp_subevent_signaling_media_codec_sbc_configuration_get_num_channels(packet);
@@ -554,10 +560,11 @@ static void a2dp_source_packet_handler(uint8_t packet_type, uint16_t channel, ui
             sbc_configuration.min_bitpool_value = a2dp_subevent_signaling_media_codec_sbc_configuration_get_min_bitpool_value(packet);
             sbc_configuration.max_bitpool_value = a2dp_subevent_signaling_media_codec_sbc_configuration_get_max_bitpool_value(packet);
             sbc_configuration.frames_per_buffer = sbc_configuration.subbands * sbc_configuration.block_length;
-            printf("A2DP Source: Received SBC codec configuration, sampling frequency %u, a2dp_cid 0x%02x, initiator seid %d, acceptor seid %d .\n", 
+            printf("A2DP Source: Received SBC codec configuration, sampling frequency %u, a2dp_cid 0x%02x, local seid %d (expected %d), remote seid %d .\n", 
                 sbc_configuration.sampling_frequency, cid,
                 a2dp_subevent_signaling_media_codec_sbc_configuration_get_int_seid(packet),
-                a2dp_subevent_signaling_media_codec_sbc_configuration_get_acp_seid(packet));
+                media_tracker.local_seid,
+                media_tracker.remote_seid);
 
             // Adapt Bluetooth spec definition to SBC Encoder expected input
             sbc_configuration.allocation_method -= 1;
@@ -588,10 +595,12 @@ static void a2dp_source_packet_handler(uint8_t packet_type, uint16_t channel, ui
         }  
 
         case A2DP_SUBEVENT_SIGNALING_DELAY_REPORTING_CAPABILITY:
-            printf("A2DP Source: remote supports delay report\n");
+            printf("A2DP Source: remote supports delay report, remote seid %d\n", 
+                avdtp_subevent_signaling_delay_reporting_capability_get_remote_seid(packet));
             break;
         case A2DP_SUBEVENT_SIGNALING_CAPABILITIES_DONE:
-            printf("A2DP Source: All capabilities reported\n");
+            printf("A2DP Source: All capabilities reported, remote seid %d\n", 
+                avdtp_subevent_signaling_capabilities_done_get_remote_seid(packet));
             break;
 
         case A2DP_SUBEVENT_SIGNALING_DELAY_REPORT:
@@ -610,7 +619,10 @@ static void a2dp_source_packet_handler(uint8_t packet_type, uint16_t channel, ui
 
             local_seid = a2dp_subevent_stream_established_get_local_seid(packet);
             cid = a2dp_subevent_stream_established_get_a2dp_cid(packet);
-            printf("A2DP_SUBEVENT_STREAM_ESTABLISHED:  a2dp_cid [expected 0x%02x, received 0x%02x], local_seid [expected %d, received %d]\n", media_tracker.a2dp_cid, cid, media_tracker.local_seid, local_seid);
+            printf("A2DP_SUBEVENT_STREAM_ESTABLISHED:  a2dp_cid [expected 0x%02x, received 0x%02x], local_seid %d (expected %d), remote_seid %d (expected %d)\n",
+                     media_tracker.a2dp_cid, cid, 
+                     local_seid, media_tracker.local_seid, 
+                     a2dp_subevent_stream_established_get_remote_seid(packet), media_tracker.remote_seid);
 
             if (local_seid != media_tracker.local_seid){
                 printf("A2DP Source: Stream failed, wrong local seid %d, expected %d.\n", local_seid, media_tracker.local_seid);

example/ancs_client_demo.gatt

@@ -4,7 +4,7 @@ CHARACTERISTIC, GAP_APPEARANCE, READ | WRITE | DYNAMIC,
 // GAP Peripheral Privacy Flag
 CHARACTERISTIC, 2A02, READ | WRITE | DYNAMIC, 00
 PRIMARY_SERVICE, GATT_SERVICE
-CHARACTERISTIC, GATT_SERVICE_CHANGED, READ,
+CHARACTERISTIC, GATT_DATABASE_HASH, READ,
 
 
 

example/att_delayed_response.gatt

@@ -2,7 +2,7 @@ PRIMARY_SERVICE, GAP_SERVICE
 CHARACTERISTIC, GAP_DEVICE_NAME, READ, "Delayed Response"
 
 PRIMARY_SERVICE, GATT_SERVICE
-CHARACTERISTIC, GATT_SERVICE_CHANGED, READ,
+CHARACTERISTIC, GATT_DATABASE_HASH, READ,
 
 // Some Service
 PRIMARY_SERVICE, 0000FF10-0000-1000-8000-00805F9B34FB

example/gatt_counter.gatt

@@ -5,7 +5,7 @@ CHARACTERISTIC, GAP_DEVICE_NAME, READ, "LE Counter"
 #import <battery_service.gatt>
 
 PRIMARY_SERVICE, GATT_SERVICE
-CHARACTERISTIC, GATT_SERVICE_CHANGED, READ,
+CHARACTERISTIC, GATT_DATABASE_HASH, READ,
 
 // Counter Service
 PRIMARY_SERVICE, 0000FF10-0000-1000-8000-00805F9B34FB

example/gatt_streamer_server.gatt

@@ -2,7 +2,7 @@ PRIMARY_SERVICE, GAP_SERVICE
 CHARACTERISTIC, GAP_DEVICE_NAME, READ, "LE Streamer"
 
 PRIMARY_SERVICE, GATT_SERVICE
-CHARACTERISTIC, GATT_SERVICE_CHANGED, READ,
+CHARACTERISTIC, GATT_DATABASE_HASH, READ,
 
 // Test Service
 PRIMARY_SERVICE, 0000FF10-0000-1000-8000-00805F9B34FB