From edcce82e09b1f31aa7a6161665158c234a0b8324 Mon Sep 17 00:00:00 2001 From: yutao chen Date: Mon, 29 Jun 2026 17:31:22 +0800 Subject: [PATCH 1/3] Fix risk of accepting packets before firmware is loaded --- bumble/drivers/intel.py | 2 -- bumble/drivers/rtk.py | 2 -- bumble/host.py | 9 +++++++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/bumble/drivers/intel.py b/bumble/drivers/intel.py index 5dbec386e..fd3f41594 100644 --- a/bumble/drivers/intel.py +++ b/bumble/drivers/intel.py @@ -445,7 +445,6 @@ async def send_firmware_data(self, data_type: int, data: bytes) -> None: ) async def load_firmware(self) -> None: - self.host.ready = True device_info = await self.read_device_info() logger.debug( "device info: \n%s", @@ -663,7 +662,6 @@ async def reboot_bootloader(self) -> None: await asyncio.sleep(_POST_RESET_DELAY) async def read_device_info(self) -> dict[ValueType, Any]: - self.host.ready = True response1 = await self.host.send_sync_command_raw(hci.HCI_Reset_Command()) if not isinstance( response1.return_parameters, hci.HCI_StatusReturnParameters diff --git a/bumble/drivers/rtk.py b/bumble/drivers/rtk.py index 24bb78b3a..bccaea50a 100644 --- a/bumble/drivers/rtk.py +++ b/bumble/drivers/rtk.py @@ -555,11 +555,9 @@ async def driver_info_for_host(cls, host: Host) -> DriverInfo | None: hci.HCI_Reset_Command(), response_timeout=cls.POST_RESET_DELAY, ) - host.ready = True # Needed to let the host know the controller is ready. except asyncio.exceptions.TimeoutError: logger.warning("timeout waiting for hci reset, retrying") await host.send_sync_command(hci.HCI_Reset_Command()) - host.ready = True response = await host.send_sync_command_raw( hci.HCI_Read_Local_Version_Information_Command() diff --git a/bumble/host.py b/bumble/host.py index 992e042e3..15dfbdaaf 100644 --- a/bumble/host.py +++ b/bumble/host.py @@ -31,6 +31,7 @@ InvalidStateError, PhysicalTransport, ) +from bumble.drivers.intel import HCI_INTEL_READ_VERSION_COMMAND from bumble.l2cap import L2CAP_PDU from bumble.snoop import Snooper from bumble.transport.common import TransportLostError @@ -345,7 +346,8 @@ async def reset(self, driver_factory=drivers.get_driver_for_host) -> None: # Send a reset command unless a driver has already done so. if reset_needed: await self.send_sync_command(hci.HCI_Reset_Command()) - self.ready = True + + self.ready = True response1 = await self.send_sync_command( hci.HCI_Read_Local_Supported_Commands_Command() @@ -984,7 +986,10 @@ def on_packet(self, packet: bytes) -> None: if self.ready or ( isinstance(hci_packet, hci.HCI_Command_Complete_Event) - and hci_packet.command_opcode == hci.HCI_RESET_COMMAND + and ( + hci_packet.command_opcode == hci.HCI_RESET_COMMAND + or hci_packet.command_opcode == HCI_INTEL_READ_VERSION_COMMAND + ) ): self.on_hci_packet(hci_packet) else: From aab0a8569c2dc2b4e2fad49b43c38a4105738eb9 Mon Sep 17 00:00:00 2001 From: yutao chen Date: Tue, 30 Jun 2026 08:54:23 +0800 Subject: [PATCH 2/3] Format code --- bumble/host.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bumble/host.py b/bumble/host.py index 15dfbdaaf..d372dd1bd 100644 --- a/bumble/host.py +++ b/bumble/host.py @@ -346,7 +346,7 @@ async def reset(self, driver_factory=drivers.get_driver_for_host) -> None: # Send a reset command unless a driver has already done so. if reset_needed: await self.send_sync_command(hci.HCI_Reset_Command()) - + self.ready = True response1 = await self.send_sync_command( From 25d52dbd8643983e853c0ce5156aeed0e7d2c367 Mon Sep 17 00:00:00 2001 From: yutao chen Date: Thu, 9 Jul 2026 11:50:36 +0800 Subject: [PATCH 3/3] Accept packets from all vendor HCI commands --- bumble/host.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/bumble/host.py b/bumble/host.py index d372dd1bd..7a514e23d 100644 --- a/bumble/host.py +++ b/bumble/host.py @@ -31,7 +31,6 @@ InvalidStateError, PhysicalTransport, ) -from bumble.drivers.intel import HCI_INTEL_READ_VERSION_COMMAND from bumble.l2cap import L2CAP_PDU from bumble.snoop import Snooper from bumble.transport.common import TransportLostError @@ -988,7 +987,7 @@ def on_packet(self, packet: bytes) -> None: isinstance(hci_packet, hci.HCI_Command_Complete_Event) and ( hci_packet.command_opcode == hci.HCI_RESET_COMMAND - or hci_packet.command_opcode == HCI_INTEL_READ_VERSION_COMMAND + or hci_packet.command_opcode >> 10 == hci.HCI_VENDOR_OGF ) ): self.on_hci_packet(hci_packet)