diff --git a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c index 5fe87f9ff7f..5dbb0ae4189 100644 --- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c +++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c @@ -25,6 +25,7 @@ #include "net.h" #include "beacon.h" #include "btc_ble_mesh_ble.h" +#include "bta_dm_gap.h" #if CONFIG_BLE_MESH_V11_SUPPORT #include "mesh_v1.1/utils.h" @@ -32,14 +33,6 @@ struct bt_mesh_dev bt_mesh_dev; -#define BLE_MESH_BTM_CHECK_STATUS(func) do { \ - tBTM_STATUS __status = (func); \ - if ((__status != BTM_SUCCESS) && (__status != BTM_CMD_STARTED)) { \ - BT_ERR("%s, Invalid status %d", __func__, __status); \ - return -1; \ - } \ - } while(0); - #define BLE_MESH_GATT_GET_CONN_ID(conn_id) (((uint16_t)(conn_id)) >> 8) #define BLE_MESH_GATT_CREATE_CONN_ID(gatt_if, conn_id) ((uint16_t)((((uint8_t)(conn_id)) << 8) | ((uint8_t)(gatt_if)))) @@ -153,47 +146,77 @@ void bt_mesh_hci_init(void) } #if !CONFIG_BLE_MESH_USE_BLE_50 -static void bt_mesh_scan_results_change_2_bta(tBTM_INQ_RESULTS *p_inq, uint8_t *p_eir, - tBTA_DM_SEARCH_CBACK *p_scan_cback) +extern void btc_ble_legacy_gap_callback(tBTM_BLE_LEGACY_GAP_EVENT event, + tBTM_BLE_LEGACY_GAP_CB_PARAMS *params); + +static void ble_mesh_legacy_gap_callback(tBTM_BLE_LEGACY_GAP_EVENT event, + tBTM_BLE_LEGACY_GAP_CB_PARAMS *params) { - tBTM_INQ_INFO *p_inq_info = NULL; - tBTA_DM_SEARCH result = {0}; + BT_DBG("recv event %d", event); - bdcpy(result.inq_res.bd_addr, p_inq->remote_bd_addr); - result.inq_res.rssi = p_inq->rssi; - result.inq_res.ble_addr_type = p_inq->ble_addr_type; - result.inq_res.inq_result_type = p_inq->inq_result_type; - result.inq_res.device_type = p_inq->device_type; - result.inq_res.flag = p_inq->flag; - result.inq_res.adv_data_len = p_inq->adv_data_len; - result.inq_res.scan_rsp_len = p_inq->scan_rsp_len; - memcpy(result.inq_res.dev_class, p_inq->dev_class, sizeof(DEV_CLASS)); - result.inq_res.ble_evt_type = p_inq->ble_evt_type; - - /* application will parse EIR to find out remote device name */ - result.inq_res.p_eir = p_eir; - - if ((p_inq_info = BTM_InqDbRead(p_inq->remote_bd_addr)) != NULL) { - /* initialize remt_name_not_required to FALSE so that we get the name by default */ - result.inq_res.remt_name_not_required = FALSE; - } - - if (p_scan_cback) { - p_scan_cback(BTA_DM_INQ_RES_EVT, &result); - } - - if (p_inq_info) { - /* application indicates if it knows the remote name, inside the callback - copy that to the inquiry data base*/ - if (result.inq_res.remt_name_not_required) { - p_inq_info->appl_knows_rem_name = TRUE; + switch (event) { + case BTM_BLE_LEGACY_GAP_SCAN_PARAMS_SET_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_SCAN_PARAMS_SET_COMPLETE_EVT Failed"); } + break; + case BTM_BLE_LEGACY_GAP_SCAN_START_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_SCAN_START_COMPLETE_EVT Failed"); + } + break; + case BTM_BLE_LEGACY_GAP_SCAN_STOP_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_SCAN_STOP_COMPLETE_EVT Failed"); + } + break; + case BTM_BLE_LEGACY_GAP_ADV_RAW_SET_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_ADV_RAW_SET_COMPLETE_EVT Failed"); + } + break; + case BTM_BLE_LEGACY_GAP_RSP_RAW_SET_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_RSP_RAW_SET_COMPLETE_EVT Failed"); + } + break; + case BTM_BLE_LEGACY_GAP_ADV_START_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_ADV_START_COMPLETE_EVT Failed"); + } +#if BLE_MESH_DEV + else { + bt_mesh_atomic_set_bit(bt_mesh_dev.flags, BLE_MESH_DEV_ADVERTISING); + } +#endif + break; + case BTM_BLE_LEGACY_GAP_ADV_STOP_COMPLETE_EVT: + if (params->status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_ADV_STOP_COMPLETE_EVT Failed"); + } + break; +#if CONFIG_BLE_MESH_TEST_USE_WHITE_LIST + case BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT: + if (params->white_list_update.status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT Failed"); + } + break; +#endif +#if CONFIG_BLE_MESH_USE_DUPLICATE_SCAN + case BTM_BLE_LEGACY_GAP_EXCEPTION_LIST_UPDATE_EVT: + if (params->exception_list_up.status != BTM_SUCCESS) { + BT_ERR("BTM_BLE_LEGACY_GAP_EXCEPTION_LIST_UPDATE_EVT Failed"); + } + break; +#endif + default: + goto transfer_to_user; } -} -static void bt_mesh_scan_results_cb(tBTM_INQ_RESULTS *p_inq, uint8_t *p_eir) -{ - bt_mesh_scan_results_change_2_bta(p_inq, p_eir, bt_mesh_scan_result_callback); + return; + +transfer_to_user: + btc_ble_legacy_gap_callback(event, params); } #endif @@ -498,26 +521,15 @@ static int set_adv_data(uint16_t hci_op, const struct bt_mesh_adv_data *ad, size #else /* Set adv data and scan rsp data. */ if (hci_op == BLE_MESH_HCI_OP_SET_ADV_DATA) { - BLE_MESH_BTM_CHECK_STATUS(BTM_BleWriteAdvDataRaw(param.data, param.len)); + BTA_DmBleSetAdvConfigRaw(param.data, param.len); } else if (hci_op == BLE_MESH_HCI_OP_SET_SCAN_RSP_DATA) { - BLE_MESH_BTM_CHECK_STATUS(BTM_BleWriteScanRspRaw(param.data, param.len)); + BTA_DmBleSetScanRspRaw(param.data, param.len); } #endif return 0; } -#if !CONFIG_BLE_MESH_USE_BLE_50 -static void start_adv_completed_cb(uint8_t status) -{ -#if BLE_MESH_DEV - if (!status) { - bt_mesh_atomic_set_bit(bt_mesh_dev.flags, BLE_MESH_DEV_ADVERTISING); - } -#endif -} -#endif - static bool valid_scan_param(const struct bt_mesh_scan_param *param) { if (param->type != BLE_MESH_SCAN_PASSIVE && @@ -589,12 +601,11 @@ static int start_le_scan(uint8_t scan_type, uint16_t interval, uint16_t window, BTA_DmBleGapExtScan(true, 0, 0); #else /* CONFIG_BLE_MESH_USE_BLE_50 */ - BLE_MESH_BTM_CHECK_STATUS( - BTM_BleSetScanFilterParams(client_if, interval, window, scan_type, addr_type_own, - filter_dup, scan_fil_policy, NULL)); + BTA_DmSetBleScanFilterParams(client_if, interval, window, scan_type, + scan_fil_policy, addr_type_own, filter_dup); /* BLE Mesh scan permanently, so no duration of scan here */ - BLE_MESH_BTM_CHECK_STATUS(BTM_BleScan(true, 0, bt_mesh_scan_results_cb, NULL, NULL)); + BTA_DmBleScan(true, 0, bt_mesh_scan_result_callback); #endif /* CONFIG_BLE_MESH_USE_BLE_50 */ #if BLE_MESH_DEV @@ -791,7 +802,6 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param, const struct bt_mesh_adv_data *ad, size_t ad_len, const struct bt_mesh_adv_data *sd, size_t sd_len) { - tBTA_START_ADV_CMPL_CBACK *p_start_adv_cb = NULL; tBLE_ADDR_TYPE addr_type_own = 0U; tBLE_BD_ADDR p_dir_bda = {0}; tBTM_BLE_AFP adv_fil_pol = 0U; @@ -856,7 +866,6 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param, #endif adv_fil_pol = BLE_MESH_AP_SCAN_CONN_ALL; - p_start_adv_cb = start_adv_completed_cb; interval = param->interval_min; @@ -874,11 +883,8 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param, #endif /* Check if we can start adv using BTM_BleSetAdvParamsStartAdvCheck */ - BLE_MESH_BTM_CHECK_STATUS( - BTM_BleSetAdvParamsAll(interval, interval, adv_type, - addr_type_own, &p_dir_bda, - param->channel_map, adv_fil_pol, p_start_adv_cb)); - BLE_MESH_BTM_CHECK_STATUS(BTM_BleStartAdv()); + BTA_DmAdvStartWithParams(interval, interval, adv_type, + addr_type_own, param->channel_map, adv_fil_pol, &p_dir_bda); #if BLE_MESH_DEV bt_mesh_atomic_set_bit(bt_mesh_dev.flags, BLE_MESH_DEV_ADVERTISING); @@ -997,12 +1003,12 @@ int bt_mesh_ble_adv_start(const struct bt_mesh_ble_adv_param *param, if (data->adv_data_len) { set.len = data->adv_data_len; memcpy(set.data, data->adv_data, data->adv_data_len); - BLE_MESH_BTM_CHECK_STATUS(BTM_BleWriteAdvDataRaw(set.data, set.len)); + BTA_DmBleSetAdvConfigRaw(set.data, set.len); } if (data->scan_rsp_data_len && param->adv_type != BLE_MESH_ADV_NONCONN_IND) { set.len = data->scan_rsp_data_len; memcpy(set.data, data->scan_rsp_data, data->scan_rsp_data_len); - BLE_MESH_BTM_CHECK_STATUS(BTM_BleWriteScanRspRaw(set.data, set.len)); + BTA_DmBleSetScanRspRaw(set.data, set.len); } } @@ -1017,11 +1023,8 @@ int bt_mesh_ble_adv_start(const struct bt_mesh_ble_adv_param *param, } /* Check if we can start adv using BTM_BleSetAdvParamsStartAdvCheck */ - BLE_MESH_BTM_CHECK_STATUS( - BTM_BleSetAdvParamsAll(param->interval, param->interval, param->adv_type, - param->own_addr_type, &p_dir_bda, - channel_map, adv_fil_pol, NULL)); - BLE_MESH_BTM_CHECK_STATUS(BTM_BleStartAdv()); + BTA_DmAdvStartWithParams(param->interval, param->interval, param->adv_type, + param->own_addr_type, channel_map, adv_fil_pol, &p_dir_bda); return 0; } @@ -1060,7 +1063,7 @@ int bt_le_adv_stop(void) } #endif - BLE_MESH_BTM_CHECK_STATUS(BTM_BleBroadcast(false, NULL)); + BTA_DmBleAdvStop(); #if BLE_MESH_DEV bt_mesh_atomic_clear_bit(bt_mesh_dev.flags, BLE_MESH_DEV_ADVERTISING); @@ -1113,7 +1116,7 @@ int bt_le_scan_stop(void) #if CONFIG_BLE_MESH_USE_BLE_50 BTA_DmBleGapExtScan(false, 0 ,0); #else /* CONFIG_BLE_MESH_USE_BLE_50 */ - BLE_MESH_BTM_CHECK_STATUS(BTM_BleScan(false, 0, NULL, NULL, NULL)); + BTA_DmBleScan(false, 0, NULL); #endif /* CONFIG_BLE_MESH_USE_BLE_50 */ bt_mesh_atomic_clear_bit(bt_mesh_dev.flags, BLE_MESH_DEV_SCANNING); @@ -1130,10 +1133,7 @@ int bt_le_update_white_list(struct bt_mesh_white_list *wl) return -EINVAL; } - if (BTM_BleUpdateAdvWhitelist(wl->add_remove, wl->remote_bda, - wl->addr_type, (tBTM_UPDATE_WHITELIST_CBACK *)wl->update_wl_comp_cb) == false) { - return -EIO; - } + BTA_DmUpdateWhiteList(wl->add_remove, wl->remote_bda, wl->addr_type); return 0; } @@ -1754,14 +1754,7 @@ int bt_mesh_gatts_service_start(struct bt_mesh_gatt_service *svc) int bt_mesh_gatts_set_local_device_name(const char *name) { - tBTM_STATUS status = BTM_SUCCESS; - - status = BTM_SetLocalDeviceName((char *)name, BT_DEVICE_TYPE_BLE); - if (status != BTM_NO_RESOURCES) { - BT_ERR("SetLocalDevNameFail[%d]", status); - return -EIO; - } - + BTA_DmSetDeviceName((char *)name, BT_DEVICE_TYPE_BLE); return 0; } @@ -1867,7 +1860,7 @@ int bt_mesh_gattc_conn_create(const bt_mesh_addr_t *addr, uint16_t service_uuid) #if CONFIG_BLE_MESH_USE_BLE_50 BTA_DmBleGapExtScan(false, 0 ,0); #else - BLE_MESH_BTM_CHECK_STATUS(BTM_BleScan(false, 0, NULL, NULL, NULL)); + BTA_DmBleScan(false, 0, NULL); #endif bt_mesh_atomic_clear_bit(bt_mesh_dev.flags, BLE_MESH_DEV_SCANNING); } @@ -2316,11 +2309,7 @@ static void bt_mesh_bta_gattc_cb(tBTA_GATTC_EVT event, tBTA_GATTC *p_data) #if CONFIG_BLE_MESH_USE_BLE_50 BTA_DmBleGapExtScan(true, 0 ,0); #else - tBTM_STATUS status = BTM_BleScan(true, 0, bt_mesh_scan_results_cb, NULL, NULL); - if (status != BTM_SUCCESS && status != BTM_CMD_STARTED) { - BT_ERR("Invalid scan status %d", status); - break; - } + BTA_DmBleScan(true, 0, bt_mesh_scan_result_callback); #endif bt_mesh_atomic_set_bit(bt_mesh_dev.flags, BLE_MESH_DEV_SCANNING); } @@ -2502,6 +2491,10 @@ void bt_mesh_adapt_init(void) /* Use unified crypto module initialization */ bt_mesh_crypto_init(); bt_mesh_atomic_set(bt_mesh_dev.flags, 0); + +#if !CONFIG_BLE_MESH_USE_BLE_50 + BTM_BleLegacyGapRegisterCallback(ble_mesh_legacy_gap_callback); +#endif } #if CONFIG_BLE_MESH_USE_DUPLICATE_SCAN @@ -2539,7 +2532,7 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info) BT_DBG("%s exceptional list, type 0x%08x", sub_code ? "Remove" : "Add", type); /* The parameter "device_info" can't be NULL in the API */ - BLE_MESH_BTM_CHECK_STATUS(BTM_UpdateBleDuplicateExceptionalList(sub_code, type, value, NULL)); + BTA_DmUpdateDuplicateExceptionalList(sub_code, type, value); return 0; } diff --git a/components/bt/host/bluedroid/Kconfig.in b/components/bt/host/bluedroid/Kconfig.in index 2a679b50c46..25d1bf169c2 100644 --- a/components/bt/host/bluedroid/Kconfig.in +++ b/components/bt/host/bluedroid/Kconfig.in @@ -1399,11 +1399,11 @@ config BT_BLE_FEAT_ISO_60_EN Enable iso 6.0 feature config BT_BLE_FEAT_ISO_BIG_BROCASTER - bool "Enable BLE iso BIG brocaster" + bool "Enable BLE iso BIG broadcaster" depends on BT_BLE_FEAT_ISO_EN default y help - Enable BLE 5.2 BIG brocaster + Enable BLE 5.2 BIG broadcaster config BT_BLE_FEAT_ISO_BIG_SYNCER bool "Enable BLE iso BIG syncer" diff --git a/components/bt/host/bluedroid/api/esp_ble_cte_api.c b/components/bt/host/bluedroid/api/esp_ble_cte_api.c index 37503c47461..faeb58e8705 100644 --- a/components/bt/host/bluedroid/api/esp_ble_cte_api.c +++ b/components/bt/host/bluedroid/api/esp_ble_cte_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -15,6 +15,9 @@ esp_err_t esp_ble_cte_register_callback(esp_ble_cte_cb_t callback) { + if (callback == NULL) { + return ESP_ERR_INVALID_ARG; + } ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); return (btc_profile_cb_set(BTC_PID_BLE_CTE, callback) == 0 ? ESP_OK : ESP_FAIL); @@ -22,6 +25,9 @@ esp_err_t esp_ble_cte_register_callback(esp_ble_cte_cb_t callback) esp_ble_cte_cb_t esp_ble_cte_get_callback(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return NULL; + } return (esp_ble_cte_cb_t) btc_profile_cb_get(BTC_PID_BLE_CTE); } @@ -30,6 +36,7 @@ esp_err_t esp_ble_cte_set_connectionless_trans_params(esp_ble_cte_connless_trans { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -38,6 +45,24 @@ esp_err_t esp_ble_cte_set_connectionless_trans_params(esp_ble_cte_connless_trans if ((cte_trans_params == NULL) || (cte_trans_params->antenna_ids == NULL)) { return ESP_ERR_INVALID_ARG; } + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + if ((cte_trans_params->switching_pattern_len < ESP_BLE_CTE_MIN_SWITCHING_PATTERN_LENGTH) || + (cte_trans_params->switching_pattern_len > ESP_BLE_CTE_MAX_SWITCHING_PATTERN_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + if ((cte_trans_params->cte_len < ESP_BLE_CTE_MIN_CTE_LENGTH) || + (cte_trans_params->cte_len > ESP_BLE_CTE_MAX_CTE_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + if (cte_trans_params->cte_type > ESP_BLE_CTE_TYPE_AOD_WITH_2US) { + return ESP_ERR_INVALID_ARG; + } + if ((cte_trans_params->cte_count < ESP_BLE_CTE_MIN_CTE_COUNT) || + (cte_trans_params->cte_count > ESP_BLE_CTE_MAX_CTE_COUNT)) { + return ESP_ERR_INVALID_ARG; + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; @@ -57,6 +82,7 @@ esp_err_t esp_ble_cte_set_connectionless_trans_enable(esp_ble_cte_trans_enable_p { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -65,6 +91,10 @@ esp_err_t esp_ble_cte_set_connectionless_trans_enable(esp_ble_cte_trans_enable_p if (cte_trans_enable == NULL) { return ESP_ERR_INVALID_ARG; } + if ((cte_trans_enable->cte_enable != ESP_BLE_CTE_ADV_WITH_CTE_DISABLE) && + (cte_trans_enable->cte_enable != ESP_BLE_CTE_ADV_WITH_CTE_ENABLE)) { + return ESP_ERR_INVALID_ARG; + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; @@ -80,14 +110,42 @@ esp_err_t esp_ble_cte_set_connectionless_iq_sampling_enable(esp_ble_cte_iq_sampl { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } - - if ((iq_sampling_en == NULL) || (iq_sampling_en->antenna_ids == NULL)) { + // iq_sampling_en must not be NULL + if (iq_sampling_en == NULL) { return ESP_ERR_INVALID_ARG; } + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + // Sampling enable must be either disable or enable + if ((iq_sampling_en->sampling_en != ESP_BLE_CTE_SAMPLING_DISABLE) && + (iq_sampling_en->sampling_en != ESP_BLE_CTE_SAMPLING_ENABLE)) { + return ESP_ERR_INVALID_ARG; + } + /* When sampling is enabled, antenna_ids and switching_pattern_len are required; when disabled they are ignored by the controller */ + if (iq_sampling_en->sampling_en == ESP_BLE_CTE_SAMPLING_ENABLE) { + // Slot duration must be either 1us or 2us + if ((iq_sampling_en->slot_dur != ESP_BLE_CTE_SLOT_DURATION_1US) && + (iq_sampling_en->slot_dur != ESP_BLE_CTE_SLOT_DURATION_2US)) { + return ESP_ERR_INVALID_ARG; + } + // Max sampled Ctes must be between 0 and 16 + if (iq_sampling_en->max_sampled_ctes > ESP_BLE_CTE_MAX_SAMPLED_CTES) { + return ESP_ERR_INVALID_ARG; + } + if (iq_sampling_en->antenna_ids == NULL) { + return ESP_ERR_INVALID_ARG; + } + if ((iq_sampling_en->switching_pattern_len < ESP_BLE_CTE_MIN_SWITCHING_PATTERN_LENGTH) || + (iq_sampling_en->switching_pattern_len > ESP_BLE_CTE_MAX_SWITCHING_PATTERN_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; @@ -97,9 +155,13 @@ esp_err_t esp_ble_cte_set_connectionless_iq_sampling_enable(esp_ble_cte_iq_sampl arg.cte_iq_sampling_en.sampling_en = iq_sampling_en->sampling_en; arg.cte_iq_sampling_en.slot_dur = iq_sampling_en->slot_dur; arg.cte_iq_sampling_en.max_sampled_ctes = iq_sampling_en->max_sampled_ctes; - arg.cte_iq_sampling_en.switching_pattern_len = iq_sampling_en->switching_pattern_len; - arg.cte_iq_sampling_en.antenna_ids = iq_sampling_en->antenna_ids; - + if (iq_sampling_en->sampling_en == ESP_BLE_CTE_SAMPLING_ENABLE) { + arg.cte_iq_sampling_en.switching_pattern_len = iq_sampling_en->switching_pattern_len; + arg.cte_iq_sampling_en.antenna_ids = iq_sampling_en->antenna_ids; + } else { + arg.cte_iq_sampling_en.switching_pattern_len = 0; + arg.cte_iq_sampling_en.antenna_ids = NULL; + } return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_cte_args_t), btc_ble_cte_arg_deep_copy, btc_ble_cte_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) @@ -109,15 +171,36 @@ esp_err_t esp_ble_cte_set_connection_receive_params(esp_ble_cte_recv_params_para { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } - if ((cte_recv_params == NULL) || (cte_recv_params->antenna_ids == NULL)) { + if (cte_recv_params == NULL) { return ESP_ERR_INVALID_ARG; } - + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + if ((cte_recv_params->sampling_en != ESP_BLE_CTE_SAMPLING_DISABLE) && + (cte_recv_params->sampling_en != ESP_BLE_CTE_SAMPLING_ENABLE)) { + return ESP_ERR_INVALID_ARG; + } + /* When sampling is enabled, antenna_ids and switching_pattern_len are required; when disabled they are ignored by the controller */ + if (cte_recv_params->sampling_en == ESP_BLE_CTE_SAMPLING_ENABLE) { + if ((cte_recv_params->slot_dur != ESP_BLE_CTE_SLOT_DURATION_1US) && + (cte_recv_params->slot_dur != ESP_BLE_CTE_SLOT_DURATION_2US)) { + return ESP_ERR_INVALID_ARG; + } + if (cte_recv_params->antenna_ids == NULL) { + return ESP_ERR_INVALID_ARG; + } + if ((cte_recv_params->switching_pattern_len < ESP_BLE_CTE_MIN_SWITCHING_PATTERN_LENGTH) || + (cte_recv_params->switching_pattern_len > ESP_BLE_CTE_MAX_SWITCHING_PATTERN_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; msg.act = BTC_CTE_ACT_SET_CONN_CTE_RECV_PARAMS; @@ -125,8 +208,13 @@ esp_err_t esp_ble_cte_set_connection_receive_params(esp_ble_cte_recv_params_para arg.cte_recv_params.conn_handle = cte_recv_params->conn_handle; arg.cte_recv_params.sampling_en = cte_recv_params->sampling_en; arg.cte_recv_params.slot_dur = cte_recv_params->slot_dur; - arg.cte_recv_params.switching_pattern_len = cte_recv_params->switching_pattern_len; - arg.cte_recv_params.antenna_ids = cte_recv_params->antenna_ids; + if (cte_recv_params->sampling_en == ESP_BLE_CTE_SAMPLING_ENABLE) { + arg.cte_recv_params.switching_pattern_len = cte_recv_params->switching_pattern_len; + arg.cte_recv_params.antenna_ids = cte_recv_params->antenna_ids; + } else { + arg.cte_recv_params.switching_pattern_len = 0; + arg.cte_recv_params.antenna_ids = NULL; + } return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_cte_args_t), btc_ble_cte_arg_deep_copy, btc_ble_cte_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -135,6 +223,7 @@ esp_err_t esp_ble_cte_set_connection_transmit_params(esp_ble_cte_conn_trans_para { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -143,6 +232,18 @@ esp_err_t esp_ble_cte_set_connection_transmit_params(esp_ble_cte_conn_trans_para if ((cte_conn_trans_params == NULL) || (cte_conn_trans_params->antenna_ids == NULL)) { return ESP_ERR_INVALID_ARG; } + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + if ((cte_conn_trans_params->switching_pattern_len < ESP_BLE_CTE_MIN_SWITCHING_PATTERN_LENGTH) || + (cte_conn_trans_params->switching_pattern_len > ESP_BLE_CTE_MAX_SWITCHING_PATTERN_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + /* cte_types must be non-zero and only allowed bits (AOA, AoD 1us, AoD 2us) */ + if ((cte_conn_trans_params->cte_types == 0) || + (cte_conn_trans_params->cte_types & ~ESP_BLE_CTE_TYPES_ALL)) { + return ESP_ERR_INVALID_ARG; + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; @@ -160,6 +261,7 @@ esp_err_t esp_ble_cte_connection_cte_request_enable(esp_ble_cte_req_en_params_t { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -168,6 +270,22 @@ esp_err_t esp_ble_cte_connection_cte_request_enable(esp_ble_cte_req_en_params_t if (cte_conn_req_en == NULL) { return ESP_ERR_INVALID_ARG; } + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + if ((cte_conn_req_en->enable != ESP_BLE_CTE_REQUEST_FOR_CONNECTION_DISABLE) && + (cte_conn_req_en->enable != ESP_BLE_CTE_REQUEST_FOR_CONNECTION_ENABLE)) { + return ESP_ERR_INVALID_ARG; + } + if (cte_conn_req_en->enable == ESP_BLE_CTE_REQUEST_FOR_CONNECTION_ENABLE) { + if ((cte_conn_req_en->req_cte_len < ESP_BLE_CTE_MIN_REQUESTED_CTE_LENGTH) || + (cte_conn_req_en->req_cte_len > ESP_BLE_CTE_MAX_REQUESTED_CTE_LENGTH)) { + return ESP_ERR_INVALID_ARG; + } + if (cte_conn_req_en->req_cte_Type > ESP_BLE_CTE_TYPE_AOD_WITH_2US) { + return ESP_ERR_INVALID_ARG; + } + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; @@ -186,6 +304,7 @@ esp_err_t esp_ble_cte_connection_cte_response_enable(esp_ble_cte_rsp_en_params_t { btc_msg_t msg; btc_ble_cte_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -194,6 +313,13 @@ esp_err_t esp_ble_cte_connection_cte_response_enable(esp_ble_cte_rsp_en_params_t if (cte_conn_rsp_en == NULL) { return ESP_ERR_INVALID_ARG; } + // The controller has performed parameter checking, and the host will no longer verify the validity of these parameters repeatedly. +#if (0) + if ((cte_conn_rsp_en->enable != ESP_BLE_CTE_RESPONSE_FOR_CONNECTION_DISABLE) && + (cte_conn_rsp_en->enable != ESP_BLE_CTE_RESPONSE_FOR_CONNECTION_ENABLE)) { + return ESP_ERR_INVALID_ARG; + } +#endif msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_BLE_CTE; diff --git a/components/bt/host/bluedroid/api/esp_ble_iso_api.c b/components/bt/host/bluedroid/api/esp_ble_iso_api.c index d2239844f0c..132b8880add 100644 --- a/components/bt/host/bluedroid/api/esp_ble_iso_api.c +++ b/components/bt/host/bluedroid/api/esp_ble_iso_api.c @@ -14,6 +14,9 @@ esp_err_t esp_ble_iso_register_callback(esp_ble_iso_cb_t callback) { + if (callback == NULL) { + return ESP_ERR_INVALID_ARG; + } ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); return (btc_profile_cb_set(BTC_PID_ISO_BLE, callback) == 0 ? ESP_OK : ESP_FAIL); @@ -21,23 +24,55 @@ esp_err_t esp_ble_iso_register_callback(esp_ble_iso_cb_t callback) esp_ble_iso_cb_t esp_ble_iso_get_callback(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return NULL; + } + return (esp_ble_iso_cb_t) btc_profile_cb_get(BTC_PID_ISO_BLE); } -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) esp_err_t esp_ble_iso_create_big(esp_ble_iso_big_creat_params_t *big_creat_param) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (big_creat_param == NULL) { return ESP_ERR_INVALID_ARG; } - - if (big_creat_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { + if (big_creat_param->num_bis == 0 || big_creat_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->num_bis > ESP_BLE_MAX_BIS_NUM) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->sdu_interval < BLE_ISO_SDU_INT_MIN || big_creat_param->sdu_interval > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->max_sdu < 0x0001 || big_creat_param->max_sdu > 0x0FFF) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->max_transport_latency < BLE_ISO_MAX_TRANSPORT_LATENCY_MIN || + big_creat_param->max_transport_latency > BLE_ISO_MAX_TRANSPORT_LATENCY_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->rtn > 0x1E) { + return ESP_ERR_INVALID_ARG; + } + if ((big_creat_param->phy != 0x01) && (big_creat_param->phy != 0x02) && (big_creat_param->phy != 0x04)) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->packing > 0x01) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->framing > BLE_ISO_FRAMING_FRAMED_PDU_UNSEGMENTABLE_MODE) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_param->encryption > 0x01) { return ESP_ERR_INVALID_ARG; } @@ -53,18 +88,58 @@ esp_err_t esp_ble_iso_create_big(esp_ble_iso_big_creat_params_t *big_creat_param esp_err_t esp_ble_iso_create_big_test(esp_ble_iso_big_creat_test_params_t *big_creat_test_param) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (big_creat_test_param == NULL) { return ESP_ERR_INVALID_ARG; } - - if (big_creat_test_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { + if (big_creat_test_param->num_bis == 0 || big_creat_test_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { return ESP_ERR_INVALID_ARG; } + if (big_creat_test_param->num_bis > ESP_BLE_MAX_BIS_NUM) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->sdu_interval < BLE_ISO_SDU_INT_MIN || big_creat_test_param->sdu_interval > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->iso_interval < 0x0004 || big_creat_test_param->iso_interval > 0x0C80) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->nse == 0 || big_creat_test_param->nse > 0x1F) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->max_sdu < 0x0001 || big_creat_test_param->max_sdu > 0x0FFF) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->max_pdu < 0x0001 || big_creat_test_param->max_pdu > 0x00FB) { + return ESP_ERR_INVALID_ARG; + } + if ((big_creat_test_param->phy != 0x01) && (big_creat_test_param->phy != 0x02) && (big_creat_test_param->phy != 0x04)) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->framing > BLE_ISO_FRAMING_FRAMED_PDU_UNSEGMENTABLE_MODE) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->bn == 0 || big_creat_test_param->bn > 0x07) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->irc == 0 || big_creat_test_param->irc > 0x0F) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->encryption > 0x01) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->packing > 0x01) { + return ESP_ERR_INVALID_ARG; + } + if (big_creat_test_param->pto > 0x0F) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; @@ -78,11 +153,17 @@ esp_err_t esp_ble_iso_create_big_test(esp_ble_iso_big_creat_test_params_t *big_c esp_err_t esp_ble_iso_terminate_big(uint8_t big_handle, uint8_t reason) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + /* big_handle: 0x00 to 0xEF */ + if (big_handle > 0xEF) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; msg.act = BTC_ISO_ACT_BIG_TERMINATE; @@ -93,23 +174,51 @@ esp_err_t esp_ble_iso_terminate_big(uint8_t big_handle, uint8_t reason) return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_iso_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) esp_err_t esp_ble_iso_big_create_sync(esp_ble_iso_big_sync_creat_params_t *big_sync_create_param) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (big_sync_create_param == NULL) { return ESP_ERR_INVALID_ARG; } - - if (big_sync_create_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { + /* num_bis: 0x01 to 0x1F, and not more than BLE_ISO_BIS_MAX_COUNT */ + if (big_sync_create_param->num_bis == 0 || big_sync_create_param->num_bis > BLE_ISO_BIS_MAX_COUNT) { return ESP_ERR_INVALID_ARG; } + if (big_sync_create_param->num_bis > ESP_BLE_MAX_BIS_NUM) { + return ESP_ERR_INVALID_ARG; + } + if (big_sync_create_param->big_handle > 0xEF) { + return ESP_ERR_INVALID_ARG; + } + /* sync_handle: 0x0000 to 0x0EFF */ + if (big_sync_create_param->sync_handle > 0x0EFF) { + return ESP_ERR_INVALID_ARG; + } + if (big_sync_create_param->encryption > 0x01) { + return ESP_ERR_INVALID_ARG; + } + /* mse: 0x00 to 0x1F */ + if (big_sync_create_param->mse > 0x1F) { + return ESP_ERR_INVALID_ARG; + } + /* big_sync_timeout: 0x000A to 0x4000 */ + if (big_sync_create_param->big_sync_timeout < 0x000A || big_sync_create_param->big_sync_timeout > 0x4000) { + return ESP_ERR_INVALID_ARG; + } + for (uint8_t k = 0; k < big_sync_create_param->num_bis; k++) { + /* BIS index: 0x01 to 0x1F */ + if (big_sync_create_param->bis[k] == 0 || big_sync_create_param->bis[k] > 0x1F) { + return ESP_ERR_INVALID_ARG; + } + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; @@ -127,19 +236,23 @@ esp_err_t esp_ble_iso_big_create_sync(esp_ble_iso_big_sync_creat_params_t *big_s arg.iso_big_sync_creat_params.bis[i] = big_sync_create_param->bis[i]; } - // memcpy(&arg.iso_big_sync_creat_params, big_sync_create_param, sizeof(esp_ble_iso_big_sync_creat_params_t)); - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_iso_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } esp_err_t esp_ble_iso_big_terminate_sync(uint8_t big_handle) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + /* big_handle: 0x00 to 0xEF */ + if (big_handle > 0xEF) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; msg.act = BTC_ISO_ACT_BIG_SYNC_TERMINATE; @@ -155,6 +268,7 @@ esp_err_t esp_ble_iso_set_iso_data_path(esp_ble_iso_set_data_path_params_t *data { btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -175,6 +289,10 @@ esp_err_t esp_ble_iso_set_iso_data_path(esp_ble_iso_set_data_path_params_t *data if (data_path_params->data_path_dir > ESP_BLE_ISO_DATA_PATH_DIR_OUTPUT) { return ESP_ERR_INVALID_ARG; } + /* controller_delay: 0x000000 to 0x3D0900 (0 to 4 s in microseconds) */ + if (data_path_params->controller_delay > 0x3D0900) { + return ESP_ERR_INVALID_ARG; + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; @@ -198,6 +316,7 @@ esp_err_t esp_ble_iso_remove_iso_data_path(esp_ble_iso_remove_data_path_params_t { btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -226,6 +345,7 @@ esp_err_t esp_ble_iso_read_iso_tx_sync(uint16_t iso_handle) { btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -244,6 +364,7 @@ esp_err_t esp_ble_iso_read_link_quality(uint16_t iso_handle) { btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -261,14 +382,36 @@ esp_err_t esp_ble_iso_read_link_quality(uint16_t iso_handle) #if (BLE_FEAT_ISO_CIG_CENTRAL_EN == TRUE) esp_err_t esp_ble_iso_set_cig_parameters(struct esp_ble_iso_set_cig_params *cig_params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } - if ((cig_params == NULL) || (cig_params->cis_cnt > BLE_ISO_CIS_MAX_COUNT)) { + if (cig_params == NULL) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->cis_cnt == 0 || cig_params->cis_cnt > BLE_ISO_CIS_MAX_COUNT) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->sdu_int_c_to_p < BLE_ISO_SDU_INT_MIN || cig_params->sdu_int_c_to_p > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->sdu_int_p_to_c < BLE_ISO_SDU_INT_MIN || cig_params->sdu_int_p_to_c > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->worse_case_SCA > BLE_ISO_WORST_CASE_SCA_LEVEL_20_PPM) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->framing > BLE_ISO_FRAMING_FRAMED_PDU_UNSEGMENTABLE_MODE) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->mtl_c_to_p < BLE_ISO_MAX_TRANSPORT_LATENCY_MIN || cig_params->mtl_c_to_p > BLE_ISO_MAX_TRANSPORT_LATENCY_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params->mtl_p_to_c < BLE_ISO_MAX_TRANSPORT_LATENCY_MIN || cig_params->mtl_p_to_c > BLE_ISO_MAX_TRANSPORT_LATENCY_MAX) { return ESP_ERR_INVALID_ARG; } @@ -293,14 +436,33 @@ esp_err_t esp_ble_iso_set_cig_parameters(struct esp_ble_iso_set_cig_params *cig_ esp_err_t esp_ble_iso_set_cig_parameters_test(struct esp_ble_iso_set_cig_params_test *cig_params_test) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } - if ((cig_params_test == NULL) || (cig_params_test->cis_cnt > BLE_ISO_CIS_MAX_COUNT)) { + if (cig_params_test == NULL) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->cis_cnt == 0 || cig_params_test->cis_cnt > BLE_ISO_CIS_MAX_COUNT) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->sdu_int_c_to_p < BLE_ISO_SDU_INT_MIN || cig_params_test->sdu_int_c_to_p > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->sdu_int_p_to_c < BLE_ISO_SDU_INT_MIN || cig_params_test->sdu_int_p_to_c > BLE_ISO_SDU_INT_MAX) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->iso_interval < 0x0004 || cig_params_test->iso_interval > 0x0C80) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->worse_case_SCA > BLE_ISO_WORST_CASE_SCA_LEVEL_20_PPM) { + return ESP_ERR_INVALID_ARG; + } + if (cig_params_test->framing > BLE_ISO_FRAMING_FRAMED_PDU_UNSEGMENTABLE_MODE) { return ESP_ERR_INVALID_ARG; } @@ -326,14 +488,18 @@ esp_err_t esp_ble_iso_set_cig_parameters_test(struct esp_ble_iso_set_cig_params_ esp_err_t esp_ble_iso_create_cis(struct esp_ble_iso_create_cis_params *creat_cis_params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } - if ((creat_cis_params == NULL) || (creat_cis_params->cis_count > BLE_ISO_CIS_MAX_COUNT)) { + if (creat_cis_params == NULL) { + return ESP_ERR_INVALID_ARG; + } + if (creat_cis_params->cis_count == 0 || creat_cis_params->cis_count > BLE_ISO_CIS_MAX_COUNT) { return ESP_ERR_INVALID_ARG; } @@ -355,13 +521,19 @@ esp_err_t esp_ble_iso_create_cis(struct esp_ble_iso_create_cis_params *creat_cis esp_err_t esp_ble_iso_remove_cig(uint8_t cig_id) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + /* cig_id: 0x00 to 0xEF */ + if (cig_id > 0xEF) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; msg.act = BTC_ISO_ACT_REMOVE_CIG; @@ -375,12 +547,17 @@ esp_err_t esp_ble_iso_remove_cig(uint8_t cig_id) #if (BLE_FEAT_ISO_CIG_PERIPHERAL_EN == TRUE) esp_err_t esp_ble_iso_accept_cis_request(uint16_t cis_handle) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + /* Connection handle range: 0x0000 to 0x0EFF */ + if (cis_handle > 0x0EFF) { + return ESP_ERR_INVALID_ARG; + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; @@ -393,12 +570,16 @@ esp_err_t esp_ble_iso_accept_cis_request(uint16_t cis_handle) esp_err_t esp_ble_iso_reject_cis_request(uint16_t cis_handle, uint8_t reason) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (cis_handle > 0x0EFF) { + return ESP_ERR_INVALID_ARG; + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; @@ -414,12 +595,16 @@ esp_err_t esp_ble_iso_reject_cis_request(uint16_t cis_handle, uint8_t reason) #if (BLE_FEAT_ISO_CIG_EN == TRUE) esp_err_t esp_ble_iso_disconnect_cis(uint16_t cis_handle, uint8_t reason) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_iso_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; } + if (cis_handle > 0x0EFF) { + return ESP_ERR_INVALID_ARG; + } msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_ISO_BLE; diff --git a/components/bt/host/bluedroid/api/esp_bluedroid_hci.c b/components/bt/host/bluedroid/api/esp_bluedroid_hci.c index 31c1af4a8c2..4ddc169a97c 100644 --- a/components/bt/host/bluedroid/api/esp_bluedroid_hci.c +++ b/components/bt/host/bluedroid/api/esp_bluedroid_hci.c @@ -81,6 +81,8 @@ void hci_host_send_packet(uint8_t *data, uint16_t len) #else /* BT_CONTROLLER_INCLUDED == TRUE */ if (s_hci_driver_ops.send) { s_hci_driver_ops.send(data, len); + } else { + ESP_LOGE(LOG_TAG, "%s send function is not registered", __func__); } #endif /* BT_CONTROLLER_INCLUDED == TRUE */ } diff --git a/components/bt/host/bluedroid/api/esp_bt_main.c b/components/bt/host/bluedroid/api/esp_bt_main.c index cf488dd184f..61c07db7a6f 100644 --- a/components/bt/host/bluedroid/api/esp_bt_main.c +++ b/components/bt/host/bluedroid/api/esp_bt_main.c @@ -52,6 +52,7 @@ esp_err_t esp_bluedroid_enable(void) msg.act = BTC_MAIN_ACT_ENABLE; if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { + future_free(*future_p); LOG_ERROR("Bluedroid enable failed\n"); return ESP_FAIL; } @@ -148,6 +149,9 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) ret = bluedroid_config_init(cfg); if (ret != BT_STATUS_SUCCESS) { LOG_ERROR("Bluedroid stack initialize fail, ret:%d", ret); +#if HEAP_MEMORY_STATS + osi_mem_deinit(); +#endif return ESP_FAIL; } @@ -157,6 +161,11 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) ret = btc_init(); if (ret != BT_STATUS_SUCCESS) { LOG_ERROR("Bluedroid Initialize Fail"); + bluedroid_config_deinit(); +#if HEAP_MEMORY_STATS + osi_mem_deinit(); +#endif + return ESP_FAIL; } @@ -164,6 +173,12 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) *future_p = future_new(); if (*future_p == NULL) { LOG_ERROR("Bluedroid Initialize Fail!"); + btc_deinit(); + bluedroid_config_deinit(); +#if HEAP_MEMORY_STATS + osi_mem_deinit(); +#endif + return ESP_ERR_NO_MEM; } @@ -173,11 +188,22 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg) if (btc_transfer_context(&msg, NULL, 0, NULL, NULL) != BT_STATUS_SUCCESS) { LOG_ERROR("Bluedroid Initialize Fail"); + future_free(*future_p); + btc_deinit(); + bluedroid_config_deinit(); +#if HEAP_MEMORY_STATS + osi_mem_deinit(); +#endif return ESP_FAIL; } if (future_await(*future_p) == FUTURE_FAIL) { LOG_ERROR("Bluedroid Initialize Fail"); + btc_deinit(); + bluedroid_config_deinit(); +#if HEAP_MEMORY_STATS + osi_mem_deinit(); +#endif return ESP_FAIL; } diff --git a/components/bt/host/bluedroid/api/esp_gap_ble_api.c b/components/bt/host/bluedroid/api/esp_gap_ble_api.c index f22e87a7417..067de4d9871 100644 --- a/components/bt/host/bluedroid/api/esp_gap_ble_api.c +++ b/components/bt/host/bluedroid/api/esp_gap_ble_api.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -33,6 +33,7 @@ esp_err_t esp_ble_gap_config_adv_data(esp_ble_adv_data_t *adv_data) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -59,6 +60,7 @@ esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -78,6 +80,7 @@ esp_err_t esp_ble_gap_start_scanning(uint32_t duration) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -92,7 +95,7 @@ esp_err_t esp_ble_gap_start_scanning(uint32_t duration) esp_err_t esp_ble_gap_stop_scanning(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -108,6 +111,7 @@ esp_err_t esp_ble_gap_start_advertising(esp_ble_adv_params_t *adv_params) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -125,7 +129,7 @@ esp_err_t esp_ble_gap_start_advertising(esp_ble_adv_params_t *adv_params) esp_err_t esp_ble_gap_stop_advertising(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -142,6 +146,7 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if(!params) { @@ -172,6 +177,7 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_ { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -218,6 +224,7 @@ esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -243,6 +250,7 @@ esp_err_t esp_ble_gap_set_resolvable_private_address_timeout(uint16_t rpa_timeou btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -263,6 +271,7 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; @@ -277,7 +286,7 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint esp_err_t esp_ble_gap_clear_rand_addr(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -292,6 +301,7 @@ esp_err_t esp_ble_gap_config_local_privacy (bool privacy_enable) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -307,6 +317,7 @@ esp_err_t esp_ble_gap_config_local_icon (uint16_t icon) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -322,6 +333,7 @@ esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -342,7 +354,7 @@ esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda esp_err_t esp_ble_gap_clear_whitelist(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -359,6 +371,7 @@ esp_err_t esp_ble_gap_get_whitelist_size(uint16_t *length) if (length == NULL) { return ESP_FAIL; } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); btc_get_whitelist_size(length); return ESP_OK; @@ -370,6 +383,7 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr, { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -408,6 +422,7 @@ esp_err_t esp_ble_gap_set_device_name(const char *name) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -445,6 +460,7 @@ esp_err_t esp_ble_gap_set_key_material(const uint8_t session_key[16], const uint { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -507,6 +523,7 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -517,7 +534,8 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_ACT_CFG_ADV_DATA_RAW; - arg.cfg_adv_data_raw.raw_adv = raw_data; + // Check if raw_data_len is 0 and raw_data is not NULL + arg.cfg_adv_data_raw.raw_adv = (raw_data_len > 0) ? raw_data : NULL; arg.cfg_adv_data_raw.raw_adv_len = raw_data_len; return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, @@ -529,6 +547,7 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -539,7 +558,8 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_ACT_CFG_SCAN_RSP_DATA_RAW; - arg.cfg_scan_rsp_data_raw.raw_scan_rsp = raw_data; + // Check if raw_data_len is 0 and raw_data is not NULL + arg.cfg_scan_rsp_data_raw.raw_scan_rsp = (raw_data_len > 0) ? raw_data : NULL; arg.cfg_scan_rsp_data_raw.raw_scan_rsp_len = raw_data_len; return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, @@ -553,6 +573,7 @@ esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -576,6 +597,7 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -600,6 +622,7 @@ esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -624,6 +647,7 @@ esp_err_t esp_ble_gap_clean_duplicate_scan_exceptional_list(esp_duplicate_scan_e { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -671,6 +695,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type, } btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -689,6 +714,7 @@ esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_ac { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -710,6 +736,7 @@ esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -732,6 +759,7 @@ esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t pas { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -742,9 +770,9 @@ esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t pas msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_PASSKEY_REPLY_EVT; - arg.enc_passkey_replay.accept = accept; - arg.enc_passkey_replay.passkey = passkey; - memcpy(arg.enc_passkey_replay.bd_addr, bd_addr, ESP_BD_ADDR_LEN); + arg.enc_passkey_reply.accept = accept; + arg.enc_passkey_reply.passkey = passkey; + memcpy(arg.enc_passkey_reply.bd_addr, bd_addr, ESP_BD_ADDR_LEN); return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -754,6 +782,7 @@ esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -764,8 +793,8 @@ esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept) msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_CONFIRM_REPLY_EVT; - arg.enc_comfirm_replay.accept = accept; - memcpy(arg.enc_comfirm_replay.bd_addr, bd_addr, ESP_BD_ADDR_LEN); + arg.enc_confirm_reply.accept = accept; + memcpy(arg.enc_confirm_reply.bd_addr, bd_addr, ESP_BD_ADDR_LEN); return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); @@ -775,6 +804,9 @@ esp_err_t esp_ble_remove_bond_device(esp_bd_addr_t bd_addr) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); + + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (bd_addr == NULL) { return ESP_ERR_INVALID_ARG; @@ -831,6 +863,7 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len) btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -853,6 +886,7 @@ esp_err_t esp_ble_sc_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t p_c[16], uint8 btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -871,6 +905,8 @@ esp_err_t esp_ble_create_sc_oob_data(void) { btc_msg_t msg = {0}; + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SC_CR_OOB_DATA_EVT; @@ -905,6 +941,7 @@ esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -922,10 +959,11 @@ esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device) esp_err_t esp_ble_get_current_conn_params(esp_bd_addr_t bd_addr, esp_gap_conn_params_t *conn_params) { - if(!bd_addr || !conn_params) { + if (!bd_addr || !conn_params) { return ESP_ERR_INVALID_ARG; } - if(BTM_GetCurrentConnParams(bd_addr, &conn_params->interval, &conn_params->latency, &conn_params->timeout)) { + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (BTM_GetCurrentConnParams(bd_addr, &conn_params->interval, &conn_params->latency, &conn_params->timeout)) { return ESP_OK; } return ESP_ERR_NOT_FOUND; @@ -935,6 +973,7 @@ esp_err_t esp_gap_ble_set_channels(esp_gap_ble_channels channels) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -959,8 +998,9 @@ esp_err_t esp_ble_gap_read_channel_map(esp_bd_addr_t bd_addr) return ESP_ERR_INVALID_ARG; } - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -978,6 +1018,7 @@ esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize) if (!bd_addr) { return ESP_ERR_INVALID_ARG; } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (BTM_Ble_Authorization(bd_addr, authorize)) { return ESP_OK; } @@ -989,6 +1030,7 @@ esp_err_t esp_ble_dtm_tx_start(const esp_ble_dtm_tx_t *tx_params) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (!tx_params) { return ESP_ERR_INVALID_ARG; @@ -1009,6 +1051,7 @@ esp_err_t esp_ble_dtm_rx_start(const esp_ble_dtm_rx_t *rx_params) { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (!rx_params) { return ESP_ERR_INVALID_ARG; @@ -1031,6 +1074,7 @@ esp_err_t esp_ble_dtm_enh_tx_start(const esp_ble_dtm_enh_tx_t *tx_params) { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (!tx_params) { return ESP_ERR_INVALID_ARG; @@ -1051,6 +1095,7 @@ esp_err_t esp_ble_dtm_enh_rx_start(const esp_ble_dtm_enh_rx_t *rx_params) { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (!rx_params) { return ESP_ERR_INVALID_ARG; @@ -1085,11 +1130,16 @@ esp_err_t esp_ble_dtm_stop(void) esp_err_t esp_ble_gap_set_privacy_mode(esp_ble_addr_type_t addr_type, esp_bd_addr_t addr, esp_ble_privacy_mode_t mode) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SET_PRIVACY_MODE; @@ -1106,11 +1156,16 @@ esp_err_t esp_ble_gap_set_privacy_mode(esp_ble_addr_type_t addr_type, esp_bd_add esp_err_t esp_ble_gap_read_phy(esp_bd_addr_t bd_addr) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_READ_PHY; @@ -1123,8 +1178,9 @@ esp_err_t esp_ble_gap_read_phy(esp_bd_addr_t bd_addr) esp_err_t esp_ble_gap_set_preferred_default_phy(esp_ble_gap_phy_mask_t tx_phy_mask, esp_ble_gap_phy_mask_t rx_phy_mask) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1144,11 +1200,16 @@ esp_err_t esp_ble_gap_set_preferred_phy(esp_bd_addr_t bd_addr, esp_ble_gap_phy_mask_t rx_phy_mask, esp_ble_gap_prefer_phy_options_t phy_options) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (bd_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SET_DEF_PHY; @@ -1164,11 +1225,16 @@ esp_err_t esp_ble_gap_set_preferred_phy(esp_bd_addr_t bd_addr, #if (BLE_50_EXTEND_ADV_EN == TRUE) esp_err_t esp_ble_gap_ext_adv_set_rand_addr(uint8_t instance, esp_bd_addr_t rand_addr) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (rand_addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SET_EXT_ADV_RAND_ADDR; @@ -1183,8 +1249,9 @@ esp_err_t esp_ble_gap_ext_adv_set_rand_addr(uint8_t instance, esp_bd_addr_t rand esp_err_t esp_ble_gap_ext_adv_set_params(uint8_t instance, const esp_ble_gap_ext_adv_params_t *params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1216,11 +1283,17 @@ esp_err_t esp_ble_gap_ext_adv_set_params(uint8_t instance, esp_err_t esp_ble_gap_config_ext_adv_data_raw(uint8_t instance, uint16_t length, const uint8_t *data) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (length != 0 && data == NULL) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW; @@ -1236,11 +1309,16 @@ esp_err_t esp_ble_gap_config_ext_adv_data_raw(uint8_t instance, uint16_t length, esp_err_t esp_ble_gap_config_ext_scan_rsp_data_raw(uint8_t instance, uint16_t length, const uint8_t *scan_rsp_data) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (length != 0 && scan_rsp_data == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW; @@ -1255,11 +1333,17 @@ esp_err_t esp_ble_gap_config_ext_scan_rsp_data_raw(uint8_t instance, uint16_t le esp_err_t esp_ble_gap_ext_adv_start(uint8_t num_adv, const esp_ble_gap_ext_adv_t *ext_adv) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (num_adv == 0 || ext_adv == NULL) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_EXT_ADV_START; @@ -1273,11 +1357,16 @@ esp_err_t esp_ble_gap_ext_adv_start(uint8_t num_adv, const esp_ble_gap_ext_adv_t esp_err_t esp_ble_gap_ext_adv_stop(uint8_t num_adv, const uint8_t *ext_adv_inst) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (num_adv > 0 && ext_adv_inst == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_EXT_ADV_STOP; @@ -1291,8 +1380,9 @@ esp_err_t esp_ble_gap_ext_adv_stop(uint8_t num_adv, const uint8_t *ext_adv_inst) esp_err_t esp_ble_gap_ext_adv_set_remove(uint8_t instance) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1307,7 +1397,7 @@ esp_err_t esp_ble_gap_ext_adv_set_remove(uint8_t instance) esp_err_t esp_ble_gap_ext_adv_set_clear(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1322,11 +1412,17 @@ esp_err_t esp_ble_gap_ext_adv_set_clear(void) #if (BLE_50_PERIODIC_ADV_EN == TRUE) esp_err_t esp_ble_gap_periodic_adv_set_params(uint8_t instance, const esp_ble_gap_periodic_adv_params_t *params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (params == NULL) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SET_PERIODIC_ADV_PARAMS; @@ -1347,11 +1443,18 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le const uint8_t *data) #endif { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (length != 0 && data == NULL) + { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_CFG_PERIODIC_ADV_DATA_RAW; @@ -1376,8 +1479,9 @@ esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance,bool include_adi) esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance) #endif { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1399,8 +1503,9 @@ esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance) esp_err_t esp_ble_gap_periodic_adv_stop(uint8_t instance) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1419,11 +1524,17 @@ esp_err_t esp_ble_gap_periodic_adv_stop(uint8_t instance) #if (BLE_50_EXTEND_SYNC_EN == TRUE) esp_err_t esp_ble_gap_periodic_adv_create_sync(const esp_ble_gap_periodic_adv_sync_params_t *params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (params == NULL) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_PERIODIC_ADV_CREATE_SYNC; @@ -1437,7 +1548,7 @@ esp_err_t esp_ble_gap_periodic_adv_create_sync(const esp_ble_gap_periodic_adv_sy esp_err_t esp_ble_gap_periodic_adv_sync_cancel(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1452,8 +1563,9 @@ esp_err_t esp_ble_gap_periodic_adv_sync_cancel(void) esp_err_t esp_ble_gap_periodic_adv_sync_terminate(uint16_t sync_handle) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1471,11 +1583,16 @@ esp_err_t esp_ble_gap_periodic_adv_add_dev_to_list(esp_ble_addr_type_t addr_type esp_bd_addr_t addr, uint8_t sid) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_PERIODIC_ADV_ADD_DEV_TO_LIST; @@ -1495,11 +1612,16 @@ esp_err_t esp_ble_gap_periodic_adv_remove_dev_from_list(esp_ble_addr_type_t addr esp_bd_addr_t addr, uint8_t sid) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_PERIODIC_REMOVE_ADD_DEV_FROM_LIST; @@ -1517,7 +1639,7 @@ esp_err_t esp_ble_gap_periodic_adv_remove_dev_from_list(esp_ble_addr_type_t addr esp_err_t esp_ble_gap_periodic_adv_clear_dev(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1535,6 +1657,7 @@ esp_err_t esp_ble_gap_get_periodic_list_size(uint8_t *size) if (size == NULL) { return ESP_FAIL; } + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); btc_get_periodic_list_size(size); return ESP_OK; @@ -1545,8 +1668,9 @@ esp_err_t esp_ble_gap_get_periodic_list_size(uint8_t *size) #if (BLE_50_EXTEND_SCAN_EN == TRUE) esp_err_t esp_ble_gap_set_ext_scan_params(const esp_ble_ext_scan_params_t *params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (!params) { return ESP_ERR_INVALID_ARG; @@ -1566,8 +1690,9 @@ esp_err_t esp_ble_gap_set_ext_scan_params(const esp_ble_ext_scan_params_t *param esp_err_t esp_ble_gap_start_ext_scan(uint32_t duration, uint16_t period) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1584,7 +1709,7 @@ esp_err_t esp_ble_gap_start_ext_scan(uint32_t duration, uint16_t period) esp_err_t esp_ble_gap_stop_ext_scan(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1602,11 +1727,16 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, const esp_ble_gap_conn_params_t *phy_2m_conn_params, const esp_ble_gap_conn_params_t *phy_coded_conn_params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (addr == NULL) { + return ESP_ERR_INVALID_ARG; + } + msg.sig = BTC_SIG_API_CALL; msg.pid = BTC_PID_GAP_BLE; msg.act = BTC_GAP_BLE_SET_EXT_PEFER_CONNET_PARAMS; @@ -1614,7 +1744,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, arg.set_ext_conn_params.phy_mask = phy_mask; if (phy_mask & ESP_BLE_GAP_PHY_1M_PREF_MASK) { if (!phy_1m_conn_params) { - return BT_STATUS_PARM_INVALID; + return ESP_ERR_INVALID_ARG; } if (ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) && @@ -1638,7 +1768,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, if (phy_mask & ESP_BLE_GAP_PHY_2M_PREF_MASK) { if (!phy_2m_conn_params) { - return BT_STATUS_PARM_INVALID; + return ESP_ERR_INVALID_ARG; } if (ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) && @@ -1662,7 +1792,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr, if (phy_mask & ESP_BLE_GAP_PHY_CODED_PREF_MASK) { if (!phy_coded_conn_params) { - return BT_STATUS_PARM_INVALID; + return ESP_ERR_INVALID_ARG; } if (ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) && @@ -1788,8 +1918,9 @@ esp_err_t esp_ble_gap_enable_monitor_adv(bool enable) #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE) esp_err_t esp_ble_gap_periodic_adv_recv_enable(uint16_t sync_handle, uint8_t enable) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1806,8 +1937,9 @@ esp_err_t esp_ble_gap_periodic_adv_recv_enable(uint16_t sync_handle, uint8_t ena esp_err_t esp_ble_gap_periodic_adv_sync_trans(esp_bd_addr_t addr, uint16_t service_data, uint16_t sync_handle) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1829,8 +1961,9 @@ esp_err_t esp_ble_gap_periodic_adv_sync_trans(esp_bd_addr_t addr, uint16_t servi esp_err_t esp_ble_gap_periodic_adv_set_info_trans(esp_bd_addr_t addr, uint16_t service_data, uint8_t adv_handle) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1852,8 +1985,9 @@ esp_err_t esp_ble_gap_periodic_adv_set_info_trans(esp_bd_addr_t addr, uint16_t s esp_err_t esp_ble_gap_set_periodic_adv_sync_trans_params(esp_bd_addr_t addr, const esp_ble_gap_past_params_t *params) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1882,6 +2016,7 @@ esp_err_t esp_ble_gap_vendor_command_send(esp_ble_vendor_cmd_params_t *vendor_cm { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -1910,6 +2045,7 @@ esp_err_t esp_ble_gap_set_vendor_event_mask(esp_ble_vendor_evt_mask_t event_mask { btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -1926,7 +2062,7 @@ esp_err_t esp_ble_gap_set_vendor_event_mask(esp_ble_vendor_evt_mask_t event_mask esp_err_t esp_ble_gap_clear_advertising(void) { - btc_msg_t msg; + btc_msg_t msg = {0}; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1939,8 +2075,9 @@ esp_err_t esp_ble_gap_clear_advertising(void) esp_err_t esp_ble_gap_set_csa_support(uint8_t csa_select) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -2014,6 +2151,7 @@ esp_err_t esp_ble_gap_enhanced_read_transmit_power_level(uint16_t conn_handle, e { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2025,7 +2163,7 @@ esp_err_t esp_ble_gap_enhanced_read_transmit_power_level(uint16_t conn_handle, e arg.enh_read_trans_pwr_level.conn_handle = conn_handle; arg.enh_read_trans_pwr_level.phy = phy; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2033,6 +2171,7 @@ esp_err_t esp_ble_gap_read_remote_transmit_power_level(uint16_t conn_handle, esp { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2044,7 +2183,7 @@ esp_err_t esp_ble_gap_read_remote_transmit_power_level(uint16_t conn_handle, esp arg.read_rem_trans_pwr_level.conn_handle = conn_handle; arg.read_rem_trans_pwr_level.phy = phy; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2052,6 +2191,7 @@ esp_err_t esp_ble_gap_set_path_loss_reporting_params(esp_ble_path_loss_rpt_param { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2071,7 +2211,7 @@ esp_err_t esp_ble_gap_set_path_loss_reporting_params(esp_ble_path_loss_rpt_param arg.set_path_loss_rpt_params.low_hysteresis = path_loss_rpt_params->low_hysteresis; arg.set_path_loss_rpt_params.min_time_spent = path_loss_rpt_params->min_time_spent; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2079,6 +2219,7 @@ esp_err_t esp_ble_gap_set_path_loss_reporting_enable(uint16_t conn_handle, bool { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2090,7 +2231,7 @@ esp_err_t esp_ble_gap_set_path_loss_reporting_enable(uint16_t conn_handle, bool arg.set_path_loss_rpt_en.conn_handle = conn_handle; arg.set_path_loss_rpt_en.enable = enable; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2098,6 +2239,7 @@ esp_err_t esp_ble_gap_set_transmit_power_reporting_enable(uint16_t conn_handle, { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2110,7 +2252,7 @@ esp_err_t esp_ble_gap_set_transmit_power_reporting_enable(uint16_t conn_handle, arg.set_trans_pwr_rpting_en.local_enable = local_enable; arg.set_trans_pwr_rpting_en.remote_enable = remote_enable; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2121,6 +2263,7 @@ esp_err_t esp_ble_gap_set_default_subrate(esp_ble_default_subrate_param_t *defau { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2140,7 +2283,7 @@ esp_err_t esp_ble_gap_set_default_subrate(esp_ble_default_subrate_param_t *defau arg.default_subrate_param.continuation_number = default_subrate_params->continuation_number; arg.default_subrate_param.supervision_timeout = default_subrate_params->supervision_timeout; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2148,6 +2291,7 @@ esp_err_t esp_ble_gap_subrate_request(esp_ble_subrate_req_param_t *subrate_req_p { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2168,7 +2312,7 @@ esp_err_t esp_ble_gap_subrate_request(esp_ble_subrate_req_param_t *subrate_req_p arg.subrate_req_param.continuation_number = subrate_req_params->continuation_number; arg.subrate_req_param.supervision_timeout = subrate_req_params->supervision_timeout; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } #endif // #if (BLE_FEAT_CONN_SUBRATING == TRUE) @@ -2176,8 +2320,9 @@ esp_err_t esp_ble_gap_subrate_request(esp_ble_subrate_req_param_t *subrate_req_p #if (BLE_50_FEATURE_SUPPORT == TRUE) esp_err_t esp_ble_gap_set_host_feature(uint16_t bit_num, uint8_t bit_val) { - btc_msg_t msg; + btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2209,6 +2354,7 @@ esp_err_t esp_ble_gap_set_periodic_adv_subevent_data(esp_ble_per_adv_subevent_da { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2238,7 +2384,7 @@ esp_err_t esp_ble_gap_set_periodic_adv_subevent_data(esp_ble_per_adv_subevent_da arg.per_adv_subevent_data_params.num_subevents_with_data = subevent_data_params->num_subevents_with_data; arg.per_adv_subevent_data_params.subevent_params = subevent_data_params->subevent_params; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2246,6 +2392,7 @@ esp_err_t esp_ble_gap_set_periodic_adv_response_data(esp_ble_per_adv_response_da { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2271,7 +2418,7 @@ esp_err_t esp_ble_gap_set_periodic_adv_response_data(esp_ble_per_adv_response_da arg.per_adv_response_data_params.response_data_len = rsp_data_params->response_data_len; arg.per_adv_response_data_params.response_data = rsp_data_params->response_data; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -2279,6 +2426,7 @@ esp_err_t esp_ble_gap_set_periodic_sync_subevent(esp_ble_per_sync_subevent_param { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2301,7 +2449,7 @@ esp_err_t esp_ble_gap_set_periodic_sync_subevent(esp_ble_per_sync_subevent_param arg.per_sync_subevent_params.num_subevents_to_sync = sync_subevent_params->num_subevents_to_sync; arg.per_sync_subevent_params.subevent = sync_subevent_params->subevent; - return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } #endif // #if (BT_BLE_FEAT_PAWR_EN == TRUE) @@ -2327,6 +2475,7 @@ esp_err_t esp_ble_cs_read_remote_supported_capabilities(uint16_t conn_handle) { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2399,6 +2548,7 @@ esp_err_t esp_ble_cs_security_enable(uint16_t conn_handle) { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2449,6 +2599,7 @@ esp_err_t esp_ble_cs_read_remote_fae_table(uint16_t conn_handle) { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2532,6 +2683,7 @@ esp_err_t esp_ble_cs_remove_config(esp_ble_cs_remove_config_params *remove_confi { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2556,6 +2708,7 @@ esp_err_t esp_ble_cs_set_channel_classification(esp_ble_cs_set_channel_class_par { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2579,6 +2732,7 @@ esp_err_t esp_ble_cs_set_procedure_params(esp_ble_cs_set_proc_params *procedure_ { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; @@ -2615,6 +2769,7 @@ esp_err_t esp_ble_cs_procedure_enable(esp_ble_cs_procedure_enable_params *proced { btc_msg_t msg = {0}; btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { return ESP_ERR_INVALID_STATE; diff --git a/components/bt/host/bluedroid/api/esp_gatt_common_api.c b/components/bt/host/bluedroid/api/esp_gatt_common_api.c index d0f3b0e02ab..9254b8d87af 100644 --- a/components/bt/host/bluedroid/api/esp_gatt_common_api.c +++ b/components/bt/host/bluedroid/api/esp_gatt_common_api.c @@ -25,6 +25,7 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu) { btc_msg_t msg = {0}; btc_ble_gatt_com_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -54,6 +55,9 @@ extern UINT16 L2CA_GetFreePktBufferNum_LE(void); uint16_t esp_ble_get_sendable_packets_num (void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return 0; + } return L2CA_GetFreePktBufferNum_LE(); } @@ -70,6 +74,9 @@ uint16_t esp_ble_get_sendable_packets_num (void) extern UINT16 L2CA_GetCurFreePktBufferNum_LE(UINT16 conn_id); uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return 0; + } return L2CA_GetCurFreePktBufferNum_LE(connid); } #endif diff --git a/components/bt/host/bluedroid/api/esp_gattc_api.c b/components/bt/host/bluedroid/api/esp_gattc_api.c index f296431ddf9..b0d2458ca3c 100644 --- a/components/bt/host/bluedroid/api/esp_gattc_api.c +++ b/components/bt/host/bluedroid/api/esp_gattc_api.c @@ -31,6 +31,9 @@ esp_err_t esp_ble_gattc_register_callback(esp_gattc_cb_t callback) esp_gattc_cb_t esp_ble_gattc_get_callback(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return NULL; + } return (esp_gattc_cb_t) btc_profile_cb_get(BTC_PID_GATTC); } @@ -38,6 +41,7 @@ esp_err_t esp_ble_gattc_app_register(uint16_t app_id) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -57,6 +61,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -72,6 +77,7 @@ esp_err_t esp_ble_gattc_enh_open(esp_gatt_if_t gattc_if, esp_ble_gatt_creat_conn { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); const esp_ble_conn_params_t *conn_params; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -216,6 +222,7 @@ esp_err_t esp_ble_gattc_aux_open_with_pawr_synced(esp_gatt_if_t gattc_if, esp_bl { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); const esp_ble_conn_params_t *conn_params; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -315,6 +322,7 @@ esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -351,6 +359,7 @@ esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -366,6 +375,7 @@ esp_err_t esp_ble_gattc_search_service(esp_gatt_if_t gattc_if, uint16_t conn_id, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -407,15 +417,16 @@ esp_gatt_status_t esp_ble_gattc_get_all_char(esp_gatt_if_t gattc_if, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if ((start_handle == 0) && (end_handle == 0)) { - *count = 0; - return ESP_GATT_INVALID_HANDLE; - } if (result == NULL || count == NULL || *count == 0) { return ESP_GATT_INVALID_PDU; } + if ((start_handle == 0) && (end_handle == 0)) { + *count = 0; + return ESP_GATT_INVALID_HANDLE; + } + uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); return btc_ble_gattc_get_all_char(conn_hdl, start_handle, end_handle, result, count, offset); } @@ -450,15 +461,15 @@ esp_gatt_status_t esp_ble_gattc_get_char_by_uuid(esp_gatt_if_t gattc_if, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (result == NULL || count == NULL || *count == 0) { + return ESP_GATT_INVALID_PDU; + } + if (start_handle == 0 && end_handle == 0) { *count = 0; return ESP_GATT_INVALID_HANDLE; } - if (result == NULL || count == NULL || *count == 0) { - return ESP_GATT_INVALID_PDU; - } - uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if,conn_id); return btc_ble_gattc_get_char_by_uuid(conn_hdl, start_handle, end_handle, char_uuid, result, count); } @@ -492,15 +503,15 @@ esp_gatt_status_t esp_ble_gattc_get_descr_by_char_handle(esp_gatt_if_t gattc_if, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (result == NULL || count == NULL || *count == 0) { + return ESP_GATT_INVALID_PDU; + } + if (char_handle == 0) { *count = 0; return ESP_GATT_INVALID_HANDLE; } - if (result == NULL || count == NULL || *count == 0) { - return ESP_GATT_INVALID_PDU; - } - uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); return btc_ble_gattc_get_descr_by_char_handle(conn_hdl, char_handle, descr_uuid, result, count); } @@ -515,15 +526,15 @@ esp_gatt_status_t esp_ble_gattc_get_include_service(esp_gatt_if_t gattc_if, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (result == NULL || count == NULL || *count == 0) { + return ESP_GATT_INVALID_PDU; + } + if (start_handle == 0 && end_handle == 0) { *count = 0; return ESP_GATT_INVALID_HANDLE; } - if (result == NULL || count == NULL || *count == 0) { - return ESP_GATT_INVALID_PDU; - } - uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); return btc_ble_gattc_get_include_service(conn_hdl, start_handle, end_handle, incl_uuid, result, count); } @@ -538,15 +549,15 @@ esp_gatt_status_t esp_ble_gattc_get_attr_count(esp_gatt_if_t gattc_if, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if (count == NULL) { + return ESP_GATT_INVALID_PDU; + } + if ((start_handle == 0 && end_handle == 0) && (type != ESP_GATT_DB_DESCRIPTOR)) { *count = 0; return ESP_GATT_INVALID_HANDLE; } - if (count == NULL) { - return ESP_GATT_INVALID_PDU; - } - uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); return btc_ble_gattc_get_attr_count(conn_hdl, type, start_handle, end_handle, char_handle, count); } @@ -556,15 +567,16 @@ esp_gatt_status_t esp_ble_gattc_get_db(esp_gatt_if_t gattc_if, uint16_t conn_id, { ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (start_handle == 0 && end_handle == 0) { - *count = 0; - return ESP_GATT_INVALID_HANDLE; - } if (db == NULL || count == NULL || *count == 0) { return ESP_GATT_INVALID_PDU; } + if (start_handle == 0 && end_handle == 0) { + *count = 0; + return ESP_GATT_INVALID_HANDLE; + } + uint16_t conn_hdl = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); return btc_ble_gattc_get_db(conn_hdl, start_handle, end_handle, db, count); } @@ -576,6 +588,7 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); tGATT_TCB *p_tcb = gatt_get_tcb_by_idx(conn_id); @@ -612,6 +625,7 @@ esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -652,10 +666,11 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (read_multi == NULL) { + if ((read_multi == NULL) || (read_multi->num_attr == 0) || (read_multi->num_attr > ESP_GATT_MAX_READ_MULTI_HANDLES)) { return ESP_ERR_INVALID_ARG; } @@ -677,12 +692,8 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if, arg.read_multiple.num_attr = read_multi->num_attr; arg.read_multiple.auth_req = auth_req; - if (read_multi->num_attr > 0) { - memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr); - } else { - LOG_ERROR("%s(), the num_attr should not be 0.", __func__); - return ESP_FAIL; - } + memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr); + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -692,10 +703,11 @@ esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); - if (read_multi == NULL) { + if ((read_multi == NULL) || (read_multi->num_attr == 0) || (read_multi->num_attr > ESP_GATT_MAX_READ_MULTI_HANDLES)) { return ESP_ERR_INVALID_ARG; } @@ -716,13 +728,8 @@ esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if, arg.read_multiple.conn_id = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id); arg.read_multiple.num_attr = read_multi->num_attr; arg.read_multiple.auth_req = auth_req; + memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr); - if (read_multi->num_attr > 0) { - memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr); - } else { - LOG_ERROR("%s(), the num_attr should not be 0.", __func__); - return ESP_FAIL; - } return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } @@ -732,6 +739,7 @@ esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -769,9 +777,14 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); + if(value == NULL || value_len == 0) { + return ESP_ERR_INVALID_ARG; + } + tGATT_TCB *p_tcb = gatt_get_tcb_by_idx(conn_id); if (!gatt_check_connection_state_by_tcb(p_tcb)) { LOG_WARN("%s, The connection not created.", __func__); @@ -812,6 +825,7 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -855,6 +869,7 @@ esp_err_t esp_ble_gattc_prepare_write(esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -896,6 +911,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -932,6 +948,7 @@ esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -949,6 +966,7 @@ esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -975,6 +993,7 @@ esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if, { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -999,6 +1018,7 @@ esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1018,6 +1038,7 @@ esp_err_t esp_ble_gattc_cache_clean(esp_bd_addr_t remote_bda) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1037,6 +1058,7 @@ esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_ad { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -1059,6 +1081,7 @@ esp_err_t esp_ble_gattc_cache_get_addr_list(esp_gatt_if_t gattc_if) { btc_msg_t msg = {0}; btc_ble_gattc_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); diff --git a/components/bt/host/bluedroid/api/esp_gatts_api.c b/components/bt/host/bluedroid/api/esp_gatts_api.c index 1d7c6961269..ceaf047875c 100644 --- a/components/bt/host/bluedroid/api/esp_gatts_api.c +++ b/components/bt/host/bluedroid/api/esp_gatts_api.c @@ -31,6 +31,9 @@ esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback) esp_gatts_cb_t esp_ble_gatts_get_callback(void) { + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return NULL; + } return (esp_gatts_cb_t) btc_profile_cb_get(BTC_PID_GATTS); } @@ -38,6 +41,7 @@ esp_err_t esp_ble_gatts_app_register(uint16_t app_id) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -59,6 +63,7 @@ esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -75,6 +80,7 @@ esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if, { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -99,6 +105,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -128,6 +135,7 @@ esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t i { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -147,6 +155,7 @@ esp_err_t esp_ble_gatts_add_char(uint16_t service_handle, esp_bt_uuid_t *char_ { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); esp_err_t status; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -191,6 +200,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle, { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); esp_err_t status; ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -231,6 +241,7 @@ esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -246,6 +257,7 @@ esp_err_t esp_ble_gatts_start_service(uint16_t service_handle) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -261,6 +273,7 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -276,15 +289,20 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle) esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle, uint16_t value_len, uint8_t *value, bool need_confirm) { + ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); if (value_len > ESP_GATT_MAX_ATTR_LEN) { LOG_ERROR("%s, value_len > ESP_GATT_MAX_ATTR_LEN.", __func__); return ESP_ERR_INVALID_SIZE; } + if(value == NULL && value_len > 0) { + return ESP_ERR_INVALID_ARG; + } + btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); - ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); tGATT_TCB *p_tcb = gatt_get_tcb_by_idx(conn_id); if (!gatt_check_connection_state_by_tcb(p_tcb)) { @@ -317,6 +335,9 @@ esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); + + // rsp may be NULL ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -342,6 +363,11 @@ esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, co { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); + + if(value == NULL && length > 0) { + return ESP_ERR_INVALID_ARG; + } ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -376,6 +402,7 @@ esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, b { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -398,6 +425,7 @@ esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id) { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); @@ -414,6 +442,7 @@ esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, e { btc_msg_t msg = {0}; btc_ble_gatts_args_t arg; + memset(&arg, 0, sizeof(arg)); ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED); diff --git a/components/bt/host/bluedroid/api/include/api/esp_ble_iso_api.h b/components/bt/host/bluedroid/api/include/api/esp_ble_iso_api.h index 5531393e77f..c2afa745c75 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_ble_iso_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_ble_iso_api.h @@ -78,7 +78,7 @@ typedef enum { #define BLE_ISO_MAX_TRANSPORT_LATENCY_MIN (0x0005) #define BLE_ISO_MAX_TRANSPORT_LATENCY_MAX (0x0FA0) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) typedef struct { uint8_t big_handle; /*!< Used to identify the BIG, value 0x00 to 0xEF */ uint8_t adv_handle; /*!< Used to identify the periodic advertising train, value 0x00 to 0xEF */ @@ -113,7 +113,7 @@ typedef struct { uint8_t broadcast_code[16]; /*!< The code used to derive the session key that is used to encrypt and decrypt BIS payloads */ } esp_ble_iso_big_creat_test_params_t; -#endif //#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif //#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) typedef struct { @@ -431,7 +431,7 @@ esp_ble_iso_cb_t esp_ble_iso_get_callback(void); -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) /** * @brief This function is called to create BIG. @@ -469,7 +469,7 @@ esp_err_t esp_ble_iso_create_big_test(esp_ble_iso_big_creat_test_params_t *big_c * */ esp_err_t esp_ble_iso_terminate_big(uint8_t big_handle, uint8_t reason); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) diff --git a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h index bc9d31f722b..8867b3637c3 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h @@ -2516,7 +2516,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_READ_LOCAL_SUPP_CAPS_EVT */ struct ble_cs_read_local_supp_caps_evt { - uint8_t status; /*!< Indicate channel sounding read local supported capabilities command successfully completed */ + esp_bt_status_t status; /*!< Indicate channel sounding read local supported capabilities command successfully completed */ uint16_t conn_handle; /*!< Connection Handle */ uint8_t num_config_supported; /*!< Number of CS configurations supported per connection */ uint16_t max_consecutive_proc_supported; /*!< 0x0000: Support for both a fixed number of consecutive CS procedures and for an indefinite number of CS procedures until termination @@ -2583,7 +2583,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_READ_REMOTE_SUPP_CAPS_CMPL_EVT */ struct ble_cs_read_remote_supp_caps { - uint8_t status; /*!< 0x00: Channel sounding read remote supported capabilities command successfully completed + esp_bt_status_t status; /*!< 0x00: Channel sounding read remote supported capabilities command successfully completed other: Channel sounding read remote supported capabilities command failed */ uint16_t conn_handle; /*!< Connection Handle */ uint8_t num_config_supported; /*!< Number of CS configurations supported per connection */ @@ -2646,7 +2646,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_SUPP_CAPS_EVT */ struct ble_cs_write_cached_remote_supp_caps { - uint8_t status; /*!< 0x00: Channel sounding write cached remote FAE table command succeeded + esp_bt_status_t status; /*!< 0x00: Channel sounding write cached remote FAE table command succeeded 0x01: Channel sounding write cached remote FAE table command failed */ uint16_t conn_handle; /*!< Connection Handle */ } cs_write_cached_remote_supp_caps; /*!< Event parameter of ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_SUPP_CAPS_EVT */ @@ -2654,7 +2654,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_SECURITY_ENABLE_CMPL_EVT */ struct ble_cs_security_enable { - uint8_t status; /*!< 0x00: Channel sounding security parameters successfully exchanged + esp_bt_status_t status; /*!< 0x00: Channel sounding security parameters successfully exchanged other: Channel sounding CS security parameter exchange failed */ uint16_t conn_handle; /*!< Connection Handle */ } cs_security_enable; /*!< Event parameter of ESP_GAP_BLE_CS_SECURITY_ENABLE_CMPL_EVT */ @@ -2662,7 +2662,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_SET_DEFAULT_SETTINGS_EVT */ struct ble_cs_set_default_settings { - uint8_t status; /*!< 0x00: Channel sounding set default settings command successfully completed + esp_bt_status_t status; /*!< 0x00: Channel sounding set default settings command successfully completed other: Channel sounding set default settings command failed*/ uint16_t conn_handle; /*!< Connection Handle */ } cs_set_default_settings; /*!< Event parameter of ESP_GAP_BLE_CS_SET_DEFAULT_SETTINGS_EVT */ @@ -2670,7 +2670,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_READ_REMOTE_FAE_TABLE_CMPL_EVT */ struct ble_cs_read_remote_fae_tab { - uint8_t status; /*!< 0x00: Channel sounding read remote FAE Table command successfully completed + esp_bt_status_t status; /*!< 0x00: Channel sounding read remote FAE Table command successfully completed other: Channel sounding read remote FAE Table command failed*/ uint16_t conn_handle; /*!< Connection Handle */ uint8_t remote_fae_table[72]; /*!< Per-channel mode-0 Frequency Actuation Error table of the remote Controller */ @@ -2679,7 +2679,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_FAE_TABLE_EVT */ struct ble_cs_write_cached_remote_fae_tab { - uint8_t status; /*!< 0x00: Channel sounding write cached remote FAE table command succeeded + esp_bt_status_t status; /*!< 0x00: Channel sounding write cached remote FAE table command succeeded other: Channel sounding write cached remote FAE table command failed */ uint16_t conn_handle; /*!< Connection Handle */ } cs_write_cached_remote_fae_tab; /*!< Event parameter of ESP_GAP_BLE_CS_WRITE_CACHED_REMOTE_FAE_TABLE_EVT */ @@ -2687,7 +2687,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_CONFIG_CMPL_EVT */ struct ble_cs_config_udpate { - uint8_t status; /*!< 0x00: Channel Sounding Configuration procedure succeeded + esp_bt_status_t status; /*!< 0x00: Channel Sounding Configuration procedure succeeded other: Channel Sounding Configuration procedure failed */ uint16_t conn_handle; /*!< Connection Handle */ uint8_t config_id; /*!< CS configuration identifier */ @@ -2748,7 +2748,7 @@ typedef union { * @brief ESP_GAP_BLE_CS_SET_PROC_PARAMS_CMPL_EVT */ struct ble_cs_set_proc_params { - uint8_t status; /*!< 0x00: Channel sounding set procedure_Parameters command successful + esp_bt_status_t status; /*!< 0x00: Channel sounding set procedure_Parameters command successful other: Channel sounding set procedure_Parameters command failed */ uint16_t conn_handle; /*!< Connection Handle */ } cs_set_proc_params; /*!< Event parameter of ESP_GAP_BLE_CS_SET_PROC_PARAMS_CMPL_EVT */ @@ -2756,14 +2756,14 @@ typedef union { * @brief ESP_GAP_BLE_CS_SET_CHANNEL_CLASS_CMPL_EVT */ struct ble_cs_set_channel_class { - uint8_t status; /*!< 0x00: Channel sounding set channel classification command successful + esp_bt_status_t status; /*!< 0x00: Channel sounding set channel classification command successful other: Channel sounding set channel classification command failed */ } cs_set_channel_class; /*!< Event parameter of ESP_GAP_BLE_CS_SET_CHANNEL_CLASS_CMPL_EVT */ /** * @brief ESP_GAP_BLE_CS_PROC_ENABLE_CMPL_EVT */ struct ble_cs_proc_enable { - uint8_t status; /*!< 0x00: Channel sounding procedure enable command successful + esp_bt_status_t status; /*!< 0x00: Channel sounding procedure enable command successful other: Channel sounding procedure enable command failed */ uint16_t conn_handle; /*!< Connection Handle */ uint8_t config_id; /*!< CS configuration identifier */ diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c index 2a7293429b5..8b44f27a28d 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c @@ -38,7 +38,9 @@ #include "bta/utl.h" #include "stack/gap_api.h" /* For GAP_BleReadPeerPrefConnParams */ #include +#include #include "device/controller.h" +#include "bta_dm_gap.h" #define LOG_TAG "bt_bta_dm" // #include "osi/include/log.h" @@ -262,6 +264,47 @@ UINT8 *g_disc_raw_data_buf; #endif #endif ///SDP_INCLUDED == TRUE +#if (BLE_INCLUDED == TRUE) +tBTM_BLE_LEGACY_GAP_CBACK ble_legacy_gap_cb; +static uint64_t ble_legacy_gap_oneshot_mask; + +void BTM_BleLegacyGapOneshotArm(tBTM_BLE_LEGACY_GAP_EVENT event) +{ + if (event < BTM_BLE_LEGACY_GAP_MAX_EVT) { + ble_legacy_gap_oneshot_mask |= (1ULL << event); + } +} + +void BTM_BleLegacyGapOneshotFireIfArmed(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params) +{ + if (event >= BTM_BLE_LEGACY_GAP_MAX_EVT) { + return; + } + uint64_t bit = (1ULL << event); + if ((ble_legacy_gap_oneshot_mask & bit) == 0) { + return; + } + ble_legacy_gap_oneshot_mask &= ~bit; + BTM_LegacyBleCallbackTrigger(event, params); +} + +void BTM_BleLegacyGapRegisterCallback(tBTM_BLE_LEGACY_GAP_CBACK cb) +{ + if (cb) { + ble_legacy_gap_cb = cb; + } else { + BTM_TRACE_ERROR("%s, register fail, the cb function is NULL.", __func__); + } +} + +void BTM_LegacyBleCallbackTrigger(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params) +{ + if (ble_legacy_gap_cb) { + ble_legacy_gap_cb(event, params); + } +} +#endif // #if (BLE_INCLUDED == TRUE) + /******************************************************************************* ** ** Function bta_dm_enable @@ -305,6 +348,10 @@ void bta_dm_enable(tBTA_DM_MSG *p_data) sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH; bta_sys_sendmsg(sys_enable_event); + } else { + // if malloc failed, restart + APPL_TRACE_ERROR("%s, failed to allocate memory for sys_enable_event", __func__); + assert(0); } } @@ -678,7 +725,11 @@ static void bta_dm_disable_timer_cback (TIMER_LIST_ENT *p_tle) #if (CLASSIC_BT_INCLUDED == TRUE) bta_sys_remove_uuid(UUID_SERVCLASS_PNP_INFORMATION); #endif // #if (CLASSIC_BT_INCLUDED == TRUE) - bta_dm_cb.p_sec_cback(BTA_DM_DISABLE_EVT, NULL); + if (bta_dm_cb.p_sec_cback) { + bta_dm_cb.p_sec_cback(BTA_DM_DISABLE_EVT, NULL); + } else { + APPL_TRACE_ERROR("%s, security callback is not registered", __func__); + } } } @@ -756,23 +807,31 @@ void bta_dm_send_vendor_hci(tBTA_DM_MSG *p_data) void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data) { - if (BTM_BleClearAdv(p_data->ble_clear_adv.p_clear_adv_cback) == FALSE) { - if (p_data->ble_clear_adv.p_clear_adv_cback) { - (*p_data->ble_clear_adv.p_clear_adv_cback)(BTA_FAILURE); - } + if (BTM_BleClearAdv() == FALSE) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = BTA_FAILURE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_CLEAR_ADV_COMPLETE_EVT, &cb_params); } } void bta_dm_ble_gap_set_csa_support(tBTA_DM_MSG *p_data) { APPL_TRACE_API("%s, csa_select = %d", __func__, p_data->ble_set_csa_support.csa_select); - BTM_BleSetCsaSupport(p_data->ble_set_csa_support.csa_select, p_data->ble_set_csa_support.p_cback); + if (BTM_BleSetCsaSupport(p_data->ble_set_csa_support.csa_select) == FALSE) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = BTA_FAILURE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_CSA_SUPPORT_COMPLETE_EVT, &cb_params); + } } void bta_dm_ble_gap_set_vendor_evt_mask(tBTA_DM_MSG *p_data) { APPL_TRACE_API("%s, evt_mask = %d", __func__, p_data->ble_set_vendor_evt_mask.evt_mask); - BTM_BleSetVendorEventMask(p_data->ble_set_vendor_evt_mask.evt_mask, p_data->ble_set_vendor_evt_mask.p_cback); + if (BTM_BleSetVendorEventMask(p_data->ble_set_vendor_evt_mask.evt_mask) == FALSE) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = BTA_FAILURE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_VENDOR_EVT_MASK_COMPLETE_EVT, &cb_params); + } } #endif // #if (BLE_VENDOR_HCI_EN == TRUE) @@ -990,21 +1049,21 @@ void bta_dm_set_min_enc_key_size (tBTA_DM_MSG *p_data) void bta_dm_ble_set_channels (tBTA_DM_MSG *p_data) { #if (BLE_INCLUDED == TRUE) - BTM_BleSetChannels (p_data->ble_set_channels.channels, p_data->ble_set_channels.set_channels_cb); + BTM_BleSetChannels (p_data->ble_set_channels.channels); #endif /// BLE_INCLUDED == TRUE } void bta_dm_update_white_list(tBTA_DM_MSG *p_data) { #if (BLE_INCLUDED == TRUE) - BTM_BleUpdateAdvWhitelist(p_data->white_list.add_remove, p_data->white_list.remote_addr, p_data->white_list.addr_type, p_data->white_list.update_wl_cb); + BTM_BleUpdateAdvWhitelist(p_data->white_list.add_remove, p_data->white_list.remote_addr, p_data->white_list.addr_type); #endif ///BLE_INCLUDED == TRUE } void bta_dm_clear_white_list(tBTA_DM_MSG *p_data) { #if (BLE_INCLUDED == TRUE) - BTM_BleClearWhitelist(p_data->white_list.update_wl_cb); + BTM_BleClearWhitelist(); #endif } @@ -1199,6 +1258,7 @@ static void bta_dm_process_remove_device(BD_ADDR bd_addr, tBT_TRANSPORT transpor *******************************************************************************/ void bta_dm_remove_device(tBTA_DM_MSG *p_data) { + // p_data is not NULL, see BTA_DmRemoveDevice() tBTA_DM_API_REMOVE_DEVICE *p_dev = &p_data->remove_dev; if (p_dev == NULL) { return; @@ -3784,19 +3844,26 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data) conn.link_down.is_removed = bta_dm_cb.device_list.peer_device[i].remove_dev_pending; - for (; i < bta_dm_cb.device_list.count ; i++) { + /* Shift remaining devices down; use i + 1 < count to avoid UINT8 underflow when count is 0 */ + for (; i + 1 < bta_dm_cb.device_list.count; i++) { memcpy(&bta_dm_cb.device_list.peer_device[i], &bta_dm_cb.device_list.peer_device[i + 1], sizeof(bta_dm_cb.device_list.peer_device[i])); } + /* Clear empty slots to avoid residual old data */ + memset(&bta_dm_cb.device_list.peer_device[bta_dm_cb.device_list.count-1], 0, + sizeof(bta_dm_cb.device_list.peer_device[0])); + + if (bta_dm_cb.device_list.count) { + bta_dm_cb.device_list.count--; + } +#if BLE_INCLUDED == TRUE + if ((p_data->acl_change.transport == BT_TRANSPORT_LE) && + (bta_dm_cb.device_list.le_count)) { + bta_dm_cb.device_list.le_count--; + } +#endif break; } - if (bta_dm_cb.device_list.count) { - bta_dm_cb.device_list.count--; - } #if BLE_INCLUDED == TRUE - if ((p_data->acl_change.transport == BT_TRANSPORT_LE) && - (bta_dm_cb.device_list.le_count)) { - bta_dm_cb.device_list.le_count--; - } conn.link_down.link_type = p_data->acl_change.transport; #endif @@ -3989,23 +4056,34 @@ static BOOLEAN bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr) { BOOLEAN is_device_deleted = FALSE; UINT16 index = 0; + + for (index = 0; index < bta_dm_cb.device_list.count; index ++) { + if (!bdcmp( bta_dm_cb.device_list.peer_device[index].peer_bdaddr, remote_bd_addr)) { + break; + } + } + if ( BTM_IsAclConnectionUp(remote_bd_addr, BT_TRANSPORT_LE) || BTM_IsAclConnectionUp(remote_bd_addr, BT_TRANSPORT_BR_EDR)) { APPL_TRACE_DEBUG("%s ACL is not down. Schedule for Dev Removal when ACL closes", __FUNCTION__); BTM_SecClearSecurityFlags (remote_bd_addr); - for (index = 0; index < bta_dm_cb.device_list.count; index ++) { - if (!bdcmp( bta_dm_cb.device_list.peer_device[index].peer_bdaddr, remote_bd_addr)) { - break; - } - } + if (index != bta_dm_cb.device_list.count) { bta_dm_cb.device_list.peer_device[index].remove_dev_pending = TRUE; } else { APPL_TRACE_ERROR(" %s Device does not exist in DB", __FUNCTION__); } } else { - is_device_deleted = BTM_SecDeleteDevice (remote_bd_addr, bta_dm_cb.device_list.peer_device[index].transport); + tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR; + if (index != bta_dm_cb.device_list.count) { + transport = bta_dm_cb.device_list.peer_device[index].transport; + } else { + // if device not found, Set transport to invalid value, try to delete both BR/EDR and LE keys + transport = BT_TRANSPORT_INVALID; + APPL_TRACE_WARNING("%s Device does not exist", __FUNCTION__); + } + is_device_deleted = BTM_SecDeleteDevice (remote_bd_addr, transport); #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE) /* need to remove all pending background connection */ BTA_GATTC_CancelOpen(0, remote_bd_addr, FALSE); @@ -5075,7 +5153,7 @@ void bta_dm_add_ble_device (tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_passkey_reply (tBTA_DM_MSG *p_data) { - if (p_data->pin_reply.accept) { + if (p_data->ble_passkey_reply.accept) { BTM_BlePasskeyReply(p_data->ble_passkey_reply.bd_addr, BTM_SUCCESS, p_data->ble_passkey_reply.passkey); } else { BTM_BlePasskeyReply(p_data->ble_passkey_reply.bd_addr, BTM_NOT_AUTHORIZED, p_data->ble_passkey_reply.passkey); @@ -5102,7 +5180,7 @@ void bta_dm_ble_confirm_reply (tBTA_DM_MSG *p_data) if (p_data->confirm.accept) { BTM_BleConfirmReply(p_data->confirm.bd_addr, BTM_SUCCESS); } else { - BTM_BleConfirmReply(p_data->ble_passkey_reply.bd_addr, BTM_NOT_AUTHORIZED); + BTM_BleConfirmReply(p_data->confirm.bd_addr, BTM_NOT_AUTHORIZED); } } @@ -5169,25 +5247,24 @@ void bta_dm_ble_set_conn_params (tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_set_scan_fil_params(tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleSetScanFilterParams (p_data->ble_set_scan_fil_params.client_if, + status = BTM_BleSetScanFilterParams (p_data->ble_set_scan_fil_params.client_if, p_data->ble_set_scan_fil_params.scan_int, p_data->ble_set_scan_fil_params.scan_window, p_data->ble_set_scan_fil_params.scan_mode, p_data->ble_set_scan_fil_params.addr_type_own, p_data->ble_set_scan_fil_params.scan_duplicate_filter, - p_data->ble_set_scan_fil_params.scan_filter_policy, - p_data->ble_set_scan_fil_params.scan_param_setup_cback) == BTM_SUCCESS) { - status = BTA_SUCCESS; + p_data->ble_set_scan_fil_params.scan_filter_policy); - } else { + if (status != BTM_SUCCESS) { APPL_TRACE_ERROR("%s(), fail to set scan params.", __func__); } - if (p_data->ble_set_scan_fil_params.scan_param_setup_cback != NULL) { - p_data->ble_set_scan_fil_params.scan_param_setup_cback(p_data->ble_set_scan_fil_params.client_if, status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SCAN_PARAMS_SET_COMPLETE_EVT, &cb_params); } #endif // #if (BLE_42_SCAN_EN == TRUE) @@ -5236,18 +5313,19 @@ void bta_dm_ble_disconnect (tBTA_DM_MSG *p_data) void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data) { tBTM_STATUS status = BTM_SET_STATIC_RAND_ADDR_FAIL; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + if (p_data->set_addr.addr_type != BLE_ADDR_RANDOM) { APPL_TRACE_ERROR("Invalid random address type = %d\n", p_data->set_addr.addr_type); - if(p_data->set_addr.p_set_rand_addr_cback) { - (*p_data->set_addr.p_set_rand_addr_cback)(status); - } - return; + goto _addr_set_end; } //send the setting random address to BTM layer status = BTM_BleSetRandAddress(p_data->set_addr.address); - if(p_data->set_addr.p_set_rand_addr_cback) { - (*p_data->set_addr.p_set_rand_addr_cback)(status); - } + +_addr_set_end: + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_RANDOM_ADDR_EVT, &cb_params); } @@ -5269,7 +5347,7 @@ void bta_dm_ble_clear_rand_address(tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_config_local_privacy (tBTA_DM_MSG *p_data) { - BTM_BleConfigPrivacy (p_data->ble_local_privacy.privacy_enable, p_data->ble_local_privacy.set_local_privacy_cback); + BTM_BleConfigPrivacy (p_data->ble_local_privacy.privacy_enable); } #endif @@ -5315,6 +5393,8 @@ void bta_dm_ble_set_key_material (tBTA_DM_MSG *p_data) void bta_dm_ble_scan (tBTA_DM_MSG *p_data) { tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + if (p_data->ble_scan.start) { /*Save the callback to be called when a scan results are available */ bta_dm_search_cb.p_scan_cback = p_data->ble_scan.p_cback; @@ -5324,10 +5404,11 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data) APPL_TRACE_WARNING(" %s start scan failed. status=0x%x\n", __FUNCTION__, status); } - if (p_data->ble_scan.p_start_scan_cback) { - status = (status == BTM_CMD_STARTED ? BTA_SUCCESS : BTA_FAILURE); - p_data->ble_scan.p_start_scan_cback(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + status = (status == BTM_CMD_STARTED ? BTA_SUCCESS : BTA_FAILURE); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SCAN_START_COMPLETE_EVT, &cb_params); + } else { bta_dm_search_cb.p_scan_cback = NULL; status = BTM_BleScan(FALSE, 0, NULL, NULL, NULL); @@ -5336,10 +5417,10 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data) APPL_TRACE_WARNING(" %s stop scan failed, status=0x%x\n", __FUNCTION__, status); } - if (p_data->ble_scan.p_stop_scan_cback) { - status = (status == BTM_CMD_STARTED ? BTA_SUCCESS : BTA_FAILURE); - p_data->ble_scan.p_stop_scan_cback(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + status = (status == BTM_CMD_STARTED ? BTA_SUCCESS : BTA_FAILURE); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SCAN_STOP_COMPLETE_EVT, &cb_params); #if (BLE_TOPOLOGY_CHECK == TRUE) // reset BLE scan link state when stop scan btm_ble_clear_topology_mask(BTM_BLE_STATE_ACTIVE_SCAN_BIT); @@ -5352,7 +5433,7 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data) #if (BLE_42_ADV_EN == TRUE) /******************************************************************************* ** -** Function bta_dm_ble_set_adv_params_all +** Function bta_dm_ble_start_adv_with_params ** ** Description This function is called to set all of the advertising parameters. ** @@ -5361,31 +5442,30 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data) ** Returns void ** *******************************************************************************/ -void bta_dm_ble_set_adv_params_all (tBTA_DM_MSG *p_data) +void bta_dm_ble_start_adv_with_params (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; - if (BTM_BleSetAdvParamsAll(p_data->ble_set_adv_params_all.adv_int_min, + tBTM_STATUS status = BTA_FAILURE; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + + status = BTM_BleStartAdvWithParams(p_data->ble_set_adv_params_all.adv_int_min, p_data->ble_set_adv_params_all.adv_int_max, p_data->ble_set_adv_params_all.adv_type, p_data->ble_set_adv_params_all.addr_type_own, p_data->ble_set_adv_params_all.p_dir_bda, p_data->ble_set_adv_params_all.channel_map, - p_data->ble_set_adv_params_all.adv_filter_policy, - p_data->ble_set_adv_params_all.p_start_adv_cback) == BTM_SUCCESS) { - APPL_TRACE_DEBUG("%s(), success to set ble adv params.", __func__); - } else { - APPL_TRACE_ERROR("%s(), fail to set ble adv params.", __func__); - if(p_data->ble_set_adv_params_all.p_start_adv_cback) { - (*p_data->ble_set_adv_params_all.p_start_adv_cback)(status); - } - return; - } - if(BTM_BleStartAdv() == BTM_SUCCESS) { - status = BTA_SUCCESS; - } - if(p_data->ble_set_adv_params_all.p_start_adv_cback) { - (*p_data->ble_set_adv_params_all.p_start_adv_cback)(status); + p_data->ble_set_adv_params_all.adv_filter_policy); + + if (status != BTM_SUCCESS) { + APPL_TRACE_ERROR("fail to set ble adv params."); + goto _adv_param_error; } + + status = BTM_BleStartAdv(); + +_adv_param_error: + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_ADV_START_COMPLETE_EVT, &cb_params); } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -5402,8 +5482,7 @@ void bta_dm_ble_update_duplicate_exceptional_list(tBTA_DM_MSG *p_data) { BTM_UpdateBleDuplicateExceptionalList(p_data->ble_duplicate_exceptional_list.subcode, p_data->ble_duplicate_exceptional_list.type, - p_data->ble_duplicate_exceptional_list.device_info, - p_data->ble_duplicate_exceptional_list.exceptional_list_cb); + p_data->ble_duplicate_exceptional_list.device_info); } #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) @@ -5419,16 +5498,15 @@ void bta_dm_ble_update_duplicate_exceptional_list(tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_set_adv_config (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleWriteAdvData(p_data->ble_set_adv_data.data_mask, - (tBTM_BLE_ADV_DATA *)p_data->ble_set_adv_data.p_adv_cfg) == BTM_SUCCESS) { - status = BTA_SUCCESS; - } + status = BTM_BleWriteAdvData(p_data->ble_set_adv_data.data_mask, + (tBTM_BLE_ADV_DATA *)p_data->ble_set_adv_data.p_adv_cfg); - if (p_data->ble_set_adv_data.p_adv_data_cback) { - (*p_data->ble_set_adv_data.p_adv_data_cback)(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_ADV_DATA_SET_COMPLETE_EVT, &cb_params); } /******************************************************************************* @@ -5442,16 +5520,15 @@ void bta_dm_ble_set_adv_config (tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_set_adv_config_raw (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleWriteAdvDataRaw(p_data->ble_set_adv_data_raw.p_raw_adv, - p_data->ble_set_adv_data_raw.raw_adv_len) == BTM_SUCCESS) { - status = BTA_SUCCESS; - } + status = BTM_BleWriteAdvDataRaw(p_data->ble_set_adv_data_raw.p_raw_adv, + p_data->ble_set_adv_data_raw.raw_adv_len); - if (p_data->ble_set_adv_data_raw.p_adv_data_cback) { - (*p_data->ble_set_adv_data_raw.p_adv_data_cback)(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_ADV_RAW_SET_COMPLETE_EVT, &cb_params); } /******************************************************************************* @@ -5465,16 +5542,15 @@ void bta_dm_ble_set_adv_config_raw (tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_set_scan_rsp (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleWriteScanRsp(p_data->ble_set_adv_data.data_mask, - (tBTM_BLE_ADV_DATA *)p_data->ble_set_adv_data.p_adv_cfg) == BTM_SUCCESS) { - status = BTA_SUCCESS; - } + status = BTM_BleWriteScanRsp(p_data->ble_set_adv_data.data_mask, + (tBTM_BLE_ADV_DATA *)p_data->ble_set_adv_data.p_adv_cfg); - if (p_data->ble_set_adv_data.p_adv_data_cback) { - (*p_data->ble_set_adv_data.p_adv_data_cback)(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SCAN_RSP_SET_COMPLETE_EVT, &cb_params); } /******************************************************************************* @@ -5488,16 +5564,15 @@ void bta_dm_ble_set_scan_rsp (tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_set_scan_rsp_raw (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleWriteScanRspRaw(p_data->ble_set_adv_data_raw.p_raw_adv, - p_data->ble_set_adv_data_raw.raw_adv_len) == BTM_SUCCESS) { - status = BTA_SUCCESS; - } + status = BTM_BleWriteScanRspRaw(p_data->ble_set_adv_data_raw.p_raw_adv, + p_data->ble_set_adv_data_raw.raw_adv_len); - if (p_data->ble_set_adv_data_raw.p_adv_data_cback) { - (*p_data->ble_set_adv_data_raw.p_adv_data_cback)(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_RSP_RAW_SET_COMPLETE_EVT, &cb_params); } #endif // #if (BLE_42_ADV_EN == TRUE) /******************************************************************************* @@ -5513,18 +5588,24 @@ void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data) { UINT8 status = BTM_SUCCESS; tACL_CONN *p_acl_cb = btm_bda_to_acl(p_data->ble_set_data_length.remote_bda, BT_TRANSPORT_LE); + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + uint16_t length; + if (p_acl_cb == NULL) { APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__); + length = controller_get_interface()->get_acl_data_size_ble(); + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.data_length_params.status = BTM_UNKNOWN_ADDR; + cb_params.data_length_params.rx_len = length; + cb_params.data_length_params.tx_len = length; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT, &cb_params); return; } - p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback; // if the value of the data length is same, trigger callback directly if(p_data->ble_set_data_length.tx_data_length == p_acl_cb->data_length_params.tx_len) { - if(p_data->ble_set_data_length.p_set_pkt_data_cback) { - (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params); - } - return; + + goto _data_length_set_complete; } if(p_acl_cb->data_len_updating) { @@ -5533,7 +5614,6 @@ void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data) status = BTM_ILLEGAL_ACTION; } else { // save the command - p_acl_cb->p_set_data_len_cback_waiting = p_data->ble_set_data_length.p_set_pkt_data_cback; p_acl_cb->tx_len_waiting = p_data->ble_set_data_length.tx_data_length; p_acl_cb->data_len_waiting = true; return; @@ -5542,18 +5622,28 @@ void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data) status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda, p_data->ble_set_data_length.tx_data_length); } + if (status != BTM_SUCCESS) { APPL_TRACE_ERROR("%s failed\n", __FUNCTION__); - } - if (p_data->ble_set_data_length.p_set_pkt_data_cback && status != BTM_SUCCESS) { if (p_acl_cb->data_length_params.tx_len == 0){ - uint16_t length = controller_get_interface()->get_acl_data_size_ble(); + length = controller_get_interface()->get_acl_data_size_ble(); p_acl_cb->data_length_params.rx_len = length; p_acl_cb->data_length_params.tx_len = length; } - (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params); + + goto _data_length_set_complete; + } else { + return; } +_data_length_set_complete: + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.data_length_params.status = status; + cb_params.data_length_params.rx_len = p_acl_cb->data_length_params.rx_len; + cb_params.data_length_params.tx_len = p_acl_cb->data_length_params.tx_len; + + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT, &cb_params); + } #if (BLE_42_ADV_EN == TRUE) @@ -5568,18 +5658,18 @@ void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data) *******************************************************************************/ void bta_dm_ble_advstop (tBTA_DM_MSG *p_data) { - tBTA_STATUS status = BTA_FAILURE; - BOOLEAN start = p_data->ble_observe.start; + tBTM_STATUS status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; - if (BTM_BleBroadcast(start, p_data->ble_observe.p_stop_adv_cback) == BTM_SUCCESS) { - status = BTA_SUCCESS; - } else { + status = BTM_BleAdvStop(); + + if (status != BTM_SUCCESS) { APPL_TRACE_ERROR("%s failed\n", __FUNCTION__); } - if (p_data->ble_observe.p_stop_adv_cback){ - (*p_data->ble_observe.p_stop_adv_cback)(status); - } + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_ADV_STOP_COMPLETE_EVT, &cb_params); } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -5606,7 +5696,7 @@ void bta_dm_ble_gap_dtm_stop(tBTA_DM_MSG *p_data) void bta_dm_ble_gap_set_rpa_timeout(tBTA_DM_MSG *p_data) { APPL_TRACE_API("%s, rpa_timeout = %d", __func__, p_data->set_rpa_timeout.rpa_timeout); - BTM_BleSetRpaTimeout(p_data->set_rpa_timeout.rpa_timeout,p_data->set_rpa_timeout.p_set_rpa_timeout_cback); + BTM_BleSetRpaTimeout(p_data->set_rpa_timeout.rpa_timeout); } void bta_dm_ble_gap_add_dev_to_resolving_list(tBTA_DM_MSG *p_data) @@ -5614,21 +5704,24 @@ void bta_dm_ble_gap_add_dev_to_resolving_list(tBTA_DM_MSG *p_data) APPL_TRACE_API("%s", __func__); BTM_BleAddDevToResolvingList(p_data->add_dev_to_resolving_list.addr, p_data->add_dev_to_resolving_list.addr_type, - p_data->add_dev_to_resolving_list.irk, - p_data->add_dev_to_resolving_list.p_add_dev_to_resolving_list_callback); + p_data->add_dev_to_resolving_list.irk); } void bta_dm_ble_gap_set_privacy_mode(tBTA_DM_MSG *p_data) { APPL_TRACE_API("%s, privacy_mode = %d", __func__, p_data->ble_set_privacy_mode.privacy_mode); - BTM_BleSetPrivacyMode(p_data->ble_set_privacy_mode.addr_type, p_data->ble_set_privacy_mode.addr, - p_data->ble_set_privacy_mode.privacy_mode, p_data->ble_set_privacy_mode.p_cback); + if (BTM_BleSetPrivacyMode(p_data->ble_set_privacy_mode.addr_type, p_data->ble_set_privacy_mode.addr, + p_data->ble_set_privacy_mode.privacy_mode) == FALSE) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = BTA_FAILURE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_PRIVACY_MODE_COMPLETE_EVT, &cb_params); + } } void bta_dm_read_ble_channel_map(tBTA_DM_MSG *p_data) { - if (p_data && p_data->ch_map.read_ch_map_cb) { - BTM_ReadChannelMap(p_data->ch_map.remote_addr, p_data->ch_map.read_ch_map_cb); + if (p_data) { + BTM_ReadChannelMap(p_data->ch_map.remote_addr); } } @@ -5902,7 +5995,7 @@ void bta_dm_ble_gap_enable_monitor_adv(tBTA_DM_MSG *p_data) #endif // #if (BLE_FEAT_ADV_MONITOR == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void bta_dm_ble_big_create(tBTA_DM_MSG *p_data) { APPL_TRACE_API("%s", __func__); @@ -5930,7 +6023,7 @@ void bta_dm_ble_big_terminate(tBTA_DM_MSG *p_data) tBTA_DM_BLE_BIG_TERMINATE_PARAMS param = p_data->big_terminate.big_terminate_param; BTM_BleBigTerminate(param.big_handle, param.reason); } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) void bta_dm_ble_big_sync_create(tBTA_DM_MSG *p_data) @@ -6382,7 +6475,7 @@ static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status) p_msg->disc_result.result.disc_res.raw_data_size = bta_dm_search_cb.ble_raw_used; } else { p_msg->disc_result.result.disc_res.p_raw_data = NULL; - bta_dm_search_cb.p_ble_rawdata = 0; + bta_dm_search_cb.p_ble_rawdata = NULL; } bta_sys_sendmsg(p_msg); diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c index 985990f1499..d9eba75854f 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c @@ -213,20 +213,19 @@ void BTA_DmsendVendorHciCmd(UINT16 opcode, UINT8 param_len, UINT8 *p_param_buf, ** Returns None ** *******************************************************************************/ -void BTA_DmBleClearAdv (tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback) +void BTA_DmBleClearAdv (void) { tBTA_DM_API_CLEAR_ADV *p_msg; if ((p_msg = (tBTA_DM_API_CLEAR_ADV *) osi_malloc(sizeof(tBTA_DM_API_CLEAR_ADV))) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_CLEAR_ADV_EVT; - p_msg->p_clear_adv_cback = p_clear_adv_cback; bta_sys_sendmsg(p_msg); } } -void BTA_DmBleGapSetCsaSupport(uint8_t csa_select, tBTA_SET_CSA_SUPPORT_CMPL_CBACK *p_callback) +void BTA_DmBleGapSetCsaSupport(uint8_t csa_select) { tBTA_DM_API_BLE_SET_CSA_SUPPORT *p_msg; @@ -234,12 +233,11 @@ void BTA_DmBleGapSetCsaSupport(uint8_t csa_select, tBTA_SET_CSA_SUPPORT_CMPL_CBA != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_CSA_SUPPORT_EVT; p_msg->csa_select = csa_select; - p_msg->p_cback = p_callback; bta_sys_sendmsg(p_msg); } } -void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask, tBTA_SET_VENDOR_EVT_MASK_CBACK *p_callback) +void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask) { tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK *p_msg; @@ -247,7 +245,6 @@ void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask, tBTA_SET_VENDOR_EVT_MASK_ != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_VENDOR_EVT_MASK_EVT; p_msg->evt_mask = evt_mask; - p_msg->p_cback = p_callback; bta_sys_sendmsg(p_msg); } } @@ -453,51 +450,44 @@ void BTA_DmGetRemoteName(BD_ADDR remote_addr, tBTA_CMPL_CB *rmt_name_cb) ** Returns void ** *******************************************************************************/ -void BTA_DmBleSetChannels(const uint8_t *channels, tBTA_CMPL_CB *set_channels_cb) +void BTA_DmBleSetChannels(const uint8_t *channels) { - tBTA_DM_API_BLE_SET_CHANNELS *p_msg; if ((p_msg = (tBTA_DM_API_BLE_SET_CHANNELS *) osi_malloc(sizeof(tBTA_DM_API_BLE_SET_CHANNELS))) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_CHANNELS_EVT; - - p_msg->set_channels_cb = set_channels_cb; memcpy(p_msg->channels, channels, BLE_CHANNELS_LEN); bta_sys_sendmsg(p_msg); } - - } -void BTA_DmUpdateWhiteList(BOOLEAN add_remove, BD_ADDR remote_addr, tBLE_ADDR_TYPE addr_type, tBTA_UPDATE_WHITELIST_CBACK *update_wl_cb) +void BTA_DmUpdateWhiteList(BOOLEAN add_remove, BD_ADDR remote_addr, tBLE_ADDR_TYPE addr_type) { tBTA_DM_API_UPDATE_WHITE_LIST *p_msg; if ((p_msg = (tBTA_DM_API_UPDATE_WHITE_LIST *)osi_malloc(sizeof(tBTA_DM_API_UPDATE_WHITE_LIST))) != NULL) { p_msg->hdr.event = BTA_DM_API_UPDATE_WHITE_LIST_EVT; p_msg->add_remove = add_remove; p_msg->addr_type = addr_type; - p_msg->update_wl_cb = update_wl_cb; memcpy(p_msg->remote_addr, remote_addr, sizeof(BD_ADDR)); bta_sys_sendmsg(p_msg); } } -void BTA_DmClearWhiteList(tBTA_UPDATE_WHITELIST_CBACK *update_wl_cb) +void BTA_DmClearWhiteList(void) { tBTA_DM_API_UPDATE_WHITE_LIST *p_msg; if ((p_msg = (tBTA_DM_API_UPDATE_WHITE_LIST *)osi_malloc(sizeof(tBTA_DM_API_UPDATE_WHITE_LIST))) != NULL) { p_msg->hdr.event = BTA_DM_API_CLEAR_WHITE_LIST_EVT; - p_msg->update_wl_cb = update_wl_cb; bta_sys_sendmsg(p_msg); } } -void BTA_DmBleReadChannelMap(BD_ADDR remote_device, tBTA_CMPL_CB *p_callback) +void BTA_DmBleReadChannelMap(BD_ADDR remote_device) { - if (!remote_device || !p_callback) { + if (!remote_device) { return; } tBTA_DM_API_READ_CH_MAP *p_msg; @@ -505,7 +495,6 @@ void BTA_DmBleReadChannelMap(BD_ADDR remote_device, tBTA_CMPL_CB *p_callback) if ((p_msg = (tBTA_DM_API_READ_CH_MAP *)osi_malloc(sizeof(tBTA_DM_API_READ_CH_MAP))) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_READ_CH_MAP_EVT; memcpy(p_msg->remote_addr, remote_device, sizeof(BD_ADDR)); - p_msg->read_ch_map_cb = p_callback; bta_sys_sendmsg(p_msg); } } @@ -926,11 +915,13 @@ void BTA_DmSecureConnectionOobReply(BD_ADDR bd_addr, UINT8 *p_c, UINT8 *p_r) { tBTA_DM_API_SC_OOB_REPLY *p_msg; - if ((p_msg = (tBTA_DM_API_SC_OOB_REPLY *) osi_malloc(sizeof(tBTA_DM_API_OOB_REPLY))) != NULL) { + if((p_c == NULL) || (p_r == NULL)) { + APPL_TRACE_ERROR("%s, p_c or p_r is NULL", __func__); + return; + } + + if ((p_msg = (tBTA_DM_API_SC_OOB_REPLY *) osi_malloc(sizeof(tBTA_DM_API_SC_OOB_REPLY))) != NULL) { p_msg->hdr.event = BTA_DM_API_SC_OOB_REPLY_EVT; - if((p_c == NULL) || (p_r == NULL)) { - return; - } memcpy(p_msg->bd_addr, bd_addr, BD_ADDR_LEN); memcpy(p_msg->c, p_c, BT_OCTET16_LEN); memcpy(p_msg->r, p_r, BT_OCTET16_LEN); @@ -1451,7 +1442,7 @@ void BTA_DmSetBlePrefConnParams(BD_ADDR bd_addr, *******************************************************************************/ void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window, tBLE_SCAN_MODE scan_mode, UINT8 scan_fil_poilcy, - UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback) + UINT8 addr_type_own, UINT8 scan_duplicate_filter) { tBTA_DM_API_BLE_SCAN_FILTER_PARAMS *p_msg; @@ -1465,7 +1456,6 @@ void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, p_msg->addr_type_own = addr_type_own; p_msg->scan_duplicate_filter = scan_duplicate_filter; p_msg->scan_filter_policy = scan_fil_poilcy; - p_msg->scan_param_setup_cback = scan_param_setup_cback; bta_sys_sendmsg(p_msg); } @@ -1475,22 +1465,21 @@ void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, #endif // #if (BLE_42_SCAN_EN == TRUE) #if (BLE_42_ADV_EN == TRUE) -void BTA_DmSetBleAdvParamsAll (UINT16 adv_int_min, UINT16 adv_int_max, +void BTA_DmAdvStartWithParams (UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, tBLE_ADDR_TYPE addr_type_own, tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP adv_fil_pol, - tBLE_BD_ADDR *p_dir_bda, tBTA_START_ADV_CMPL_CBACK p_start_adv_cb) + tBLE_BD_ADDR *p_dir_bda) { -#if BLE_INCLUDED == TRUE tBTA_DM_API_BLE_ADV_PARAMS_ALL *p_msg; - APPL_TRACE_API ("BTA_DmSetBleAdvParamsAll: %d, %d\n", adv_int_min, adv_int_max); + APPL_TRACE_API ("BTA_DmAdvStartWithParams: %d, %d\n", adv_int_min, adv_int_max); APPL_TRACE_API ("adv_type = %d, addr_type_own = %d, chnl_map = %d, adv_fil_pol = %d\n", adv_type, addr_type_own, chnl_map, adv_fil_pol); if ((p_msg = (tBTA_DM_API_BLE_ADV_PARAMS_ALL *) osi_malloc(sizeof(tBTA_DM_API_BLE_ADV_PARAMS_ALL) + sizeof(tBLE_BD_ADDR))) != NULL) { memset(p_msg, 0, sizeof(tBTA_DM_API_BLE_ADV_PARAMS_ALL)); - p_msg->hdr.event = BTA_DM_API_BLE_ADV_PARAM_All_EVT; + p_msg->hdr.event = BTA_DM_API_BLE_ADV_START_WITH_PARAMS_EVT; p_msg->adv_int_min = adv_int_min; p_msg->adv_int_max = adv_int_max; @@ -1498,7 +1487,6 @@ void BTA_DmSetBleAdvParamsAll (UINT16 adv_int_min, UINT16 adv_int_max, p_msg->addr_type_own = addr_type_own; p_msg->channel_map = chnl_map; p_msg->adv_filter_policy = adv_fil_pol; - p_msg->p_start_adv_cback = p_start_adv_cb; if (p_dir_bda != NULL) { p_msg->p_dir_bda = (tBLE_BD_ADDR *)(p_msg + 1); memcpy(p_msg->p_dir_bda, p_dir_bda, sizeof(tBLE_BD_ADDR)); @@ -1506,7 +1494,6 @@ void BTA_DmSetBleAdvParamsAll (UINT16 adv_int_min, UINT16 adv_int_max, bta_sys_sendmsg(p_msg); } -#endif } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -1529,13 +1516,12 @@ void BTA_DmSetBleAdvParamsAll (UINT16 adv_int_min, UINT16 adv_int_max, ** p_adv_cfg: Pointer to User defined ADV data structure. This ** memory space can not be freed until p_adv_data_cback ** is received. -** p_adv_data_cback: set adv data complete callback. +** ** ** Returns None ** *******************************************************************************/ -void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv_cfg, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback) +void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv_cfg) { tBTA_DM_API_SET_ADV_CONFIG *p_msg; @@ -1543,7 +1529,6 @@ void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG))) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_ADV_CONFIG_EVT; p_msg->data_mask = data_mask; - p_msg->p_adv_data_cback = p_adv_data_cback; p_msg->p_adv_cfg = p_adv_cfg; bta_sys_sendmsg(p_msg); @@ -1563,15 +1548,13 @@ void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv ** Returns None ** *******************************************************************************/ -void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback) +void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len) { tBTA_DM_API_SET_ADV_CONFIG_RAW *p_msg; if ((p_msg = (tBTA_DM_API_SET_ADV_CONFIG_RAW *) osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW) + raw_adv_len)) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_ADV_CONFIG_RAW_EVT; - p_msg->p_adv_data_cback = p_adv_data_cback; p_msg->p_raw_adv = (UINT8 *)(p_msg + 1); memcpy(p_msg->p_raw_adv, p_raw_adv, raw_adv_len); p_msg->raw_adv_len = raw_adv_len; @@ -1591,8 +1574,7 @@ void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len, ** Returns None ** *******************************************************************************/ -extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv_cfg, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback) +extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA *p_adv_cfg) { tBTA_DM_API_SET_ADV_CONFIG *p_msg; @@ -1600,7 +1582,6 @@ extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA * osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG))) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_SCAN_RSP_EVT; p_msg->data_mask = data_mask; - p_msg->p_adv_data_cback = p_adv_data_cback; p_msg->p_adv_cfg = p_adv_cfg; bta_sys_sendmsg(p_msg); @@ -1615,20 +1596,18 @@ extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, tBTA_BLE_ADV_DATA * ** ** Parameters p_raw_scan_rsp : raw scan_rspertising data. ** raw_scan_rsp_len : raw scan_rspertising data length. -** p_scan_rsp_data_cback : set scan_rsp data complete callback. +** ** ** Returns None ** *******************************************************************************/ -void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_scan_rsp_data_cback) +void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len) { tBTA_DM_API_SET_ADV_CONFIG_RAW *p_msg; if ((p_msg = (tBTA_DM_API_SET_ADV_CONFIG_RAW *) osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW) + raw_scan_rsp_len)) != NULL) { p_msg->hdr.event = BTA_DM_API_BLE_SET_SCAN_RSP_RAW_EVT; - p_msg->p_adv_data_cback = p_scan_rsp_data_cback; p_msg->p_raw_adv = (UINT8 *)(p_msg + 1); memcpy(p_msg->p_raw_adv, p_raw_scan_rsp, raw_scan_rsp_len); p_msg->raw_adv_len = raw_scan_rsp_len; @@ -1648,19 +1627,18 @@ void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len, ** Parameters subcode : add, remove or clean duplicate scan exceptional list. ** type : device info type. ** device_info: device info -** p_update_duplicate_ignore_list_cback : update complete callback. +** ** ** Returns None ** *******************************************************************************/ -void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, BD_ADDR device_info, tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback) +void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, BD_ADDR device_info) { tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST *p_msg; if ((p_msg = (tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST *)osi_malloc(sizeof(tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST))) != NULL) { p_msg->hdr.event = BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT; p_msg->subcode = subcode; p_msg->type = type; - p_msg->exceptional_list_cb = p_update_duplicate_exceptional_list_cback; memcpy(p_msg->device_info, device_info, sizeof(BD_ADDR)); bta_sys_sendmsg(p_msg); @@ -1681,25 +1659,21 @@ void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, BD_ADDR de ** ** Description This function starts or stops LE broadcasting. ** -** Parameters start: always be false. +** Parameters void ** ** Returns None ** *******************************************************************************/ -extern void BTA_DmBleAdvStop (BOOLEAN start, tBTA_START_STOP_ADV_CMPL_CBACK *p_start_stop_adv_cb) +extern void BTA_DmBleAdvStop (void) { - tBTA_DM_API_BLE_OBSERVE *p_msg; + tBTA_DM_API_BLE_ADVACTION *p_msg; - APPL_TRACE_API("BTA_DmBleAdvStop: start = %d \n", start); + APPL_TRACE_API("BTA_DmBleAdvStop\n"); - if ((p_msg = (tBTA_DM_API_BLE_OBSERVE *) osi_malloc(sizeof(tBTA_DM_API_BLE_OBSERVE))) != NULL) { - memset(p_msg, 0, sizeof(tBTA_DM_API_BLE_OBSERVE)); + if ((p_msg = (tBTA_DM_API_BLE_ADVACTION *) osi_malloc(sizeof(tBTA_DM_API_BLE_ADVACTION))) != NULL) { + memset(p_msg, 0, sizeof(tBTA_DM_API_BLE_ADVACTION)); p_msg->hdr.event = BTA_DM_API_BLE_ADVSTOP_EVT; - p_msg->start = start; - if (start == FALSE){ - p_msg->p_stop_adv_cback= p_start_stop_adv_cb; - } bta_sys_sendmsg(p_msg); } @@ -1939,7 +1913,7 @@ void BTA_DmBleUpdateConnectionParam(BD_ADDR bd_addr, UINT16 min_int, ** Returns void ** *******************************************************************************/ -void BTA_DmBleConfigLocalPrivacy(BOOLEAN privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback) +void BTA_DmBleConfigLocalPrivacy(BOOLEAN privacy_enable) { ///This function used the irk to generate the resolve address #if BLE_INCLUDED == TRUE && BLE_PRIVACY_SPT == TRUE @@ -1950,7 +1924,6 @@ void BTA_DmBleConfigLocalPrivacy(BOOLEAN privacy_enable, tBTA_SET_LOCAL_PRIVACY_ p_msg->hdr.event = BTA_DM_API_LOCAL_PRIVACY_EVT; p_msg->privacy_enable = privacy_enable; - p_msg->set_local_privacy_cback = set_local_privacy_cback; bta_sys_sendmsg(p_msg); } #else @@ -2083,7 +2056,7 @@ void BTA_DmBleDisconnect(BD_ADDR bd_addr) ** ** *******************************************************************************/ -void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length, tBTA_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback) +void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length) { tBTA_DM_API_BLE_SET_DATA_LENGTH *p_msg; @@ -2092,7 +2065,6 @@ void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length, tBTA_S bdcpy(p_msg->remote_bda, remote_device); p_msg->hdr.event = BTA_DM_API_SET_DATA_LENGTH_EVT; p_msg->tx_data_length = tx_data_length; - p_msg->p_set_pkt_data_cback = p_set_pkt_data_cback; bta_sys_sendmsg(p_msg); } @@ -2145,7 +2117,7 @@ void BTA_DmBleDtmStop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback) } #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) -void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t privacy_mode, tBTA_SET_PRIVACY_MODE_CMPL_CBACK *p_cback) +void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t privacy_mode) { tBTA_DM_API_SET_PRIVACY_MODE *p_msg; @@ -2155,7 +2127,6 @@ void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t privacy_mo p_msg->addr_type = addr_type; memcpy(p_msg->addr, addr, sizeof(BD_ADDR)); p_msg->privacy_mode = privacy_mode; - p_msg->p_cback = p_cback; bta_sys_sendmsg(p_msg); } } @@ -2225,8 +2196,7 @@ void BTA_DmSetEncryption(BD_ADDR bd_addr, tBTA_TRANSPORT transport, tBTA_DM_ENCR ** *******************************************************************************/ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration, - tBTA_DM_SEARCH_CBACK *p_results_cb, - tBTA_START_STOP_SCAN_CMPL_CBACK *p_start_stop_scan_cb) + tBTA_DM_SEARCH_CBACK *p_results_cb) { tBTA_DM_API_BLE_SCAN *p_msg; @@ -2239,12 +2209,6 @@ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration, p_msg->start = start; p_msg->duration = duration; p_msg->p_cback = p_results_cb; - if (start){ - p_msg->p_start_scan_cback = p_start_stop_scan_cb; - } - else { - p_msg->p_stop_scan_cback = p_start_stop_scan_cb; - } bta_sys_sendmsg(p_msg); } @@ -2263,7 +2227,7 @@ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration, ** ** *******************************************************************************/ -extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback) +extern void BTA_DmSetRandAddress(BD_ADDR rand_addr) { tBTA_DM_APT_SET_DEV_ADDR *p_msg; APPL_TRACE_API("set the random address "); @@ -2272,7 +2236,6 @@ extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_ memcpy(p_msg->address, rand_addr, BD_ADDR_LEN); p_msg->hdr.event = BTA_DM_API_SET_RAND_ADDR_EVT; p_msg->addr_type = BLE_ADDR_RANDOM; - p_msg->p_set_rand_addr_cback = p_set_rand_addr_cback; //start sent the msg to the bta system control module bta_sys_sendmsg(p_msg); } @@ -2293,14 +2256,13 @@ extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_ ** ** *******************************************************************************/ -void BTA_DmBleSetRpaTimeout(uint16_t rpa_timeout,tBTA_SET_RPA_TIMEOUT_CMPL_CBACK *p_set_rpa_timeout_cback) +void BTA_DmBleSetRpaTimeout(uint16_t rpa_timeout) { tBTA_DM_API_SET_RPA_TIMEOUT *p_msg; if ((p_msg = (tBTA_DM_API_SET_RPA_TIMEOUT *) osi_malloc(sizeof(tBTA_DM_API_SET_RPA_TIMEOUT))) != NULL) { memset(p_msg, 0, sizeof(tBTA_DM_API_SET_RPA_TIMEOUT)); p_msg->hdr.event = BTA_DM_API_SET_RPA_TIMEOUT_EVT; p_msg->rpa_timeout = rpa_timeout; // Assign the RPA timeout value to the message - p_msg->p_set_rpa_timeout_cback = p_set_rpa_timeout_cback; bta_sys_sendmsg(p_msg); } } @@ -2324,8 +2286,7 @@ void BTA_DmBleSetRpaTimeout(uint16_t rpa_timeout,tBTA_SET_RPA_TIMEOUT_CMPL_CBACK *******************************************************************************/ void BTA_DmBleAddDevToResolvingList(BD_ADDR addr, uint8_t addr_type, - PEER_IRK irk, - tBTA_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *add_dev_to_resolving_list_callback) + PEER_IRK irk) { tBTA_DM_API_ADD_DEV_TO_RESOLVING_LIST *p_msg; if ((p_msg = (tBTA_DM_API_ADD_DEV_TO_RESOLVING_LIST *) osi_malloc(sizeof(tBTA_DM_API_ADD_DEV_TO_RESOLVING_LIST))) != NULL) { @@ -2334,7 +2295,6 @@ void BTA_DmBleAddDevToResolvingList(BD_ADDR addr, memcpy(p_msg->addr, addr, BD_ADDR_LEN); // Copy the device address to the message p_msg->addr_type = addr_type; // Assign the address type to the message memcpy(p_msg->irk, irk, PEER_IRK_LEN); // Copy the IRK to the message - p_msg->p_add_dev_to_resolving_list_callback = add_dev_to_resolving_list_callback; bta_sys_sendmsg(p_msg); } } @@ -2895,9 +2855,10 @@ void BTA_DmBleGapPeriodicAdvCfgDataRaw(UINT8 instance, UINT16 length, p_msg->hdr.event = BTA_DM_API_PERIODIC_ADV_CFG_DATA_EVT; p_msg->instance = instance; p_msg->length = length; - p_msg->data = (UINT8 *)(p_msg + 1); - memcpy(p_msg->data, data, length); - p_msg->data = length != 0 ? (UINT8 *)(p_msg + 1) : NULL; + p_msg->data = (length != 0) ? (UINT8 *)(p_msg + 1) : NULL; + if (data && length) { + memcpy(p_msg->data, data, length); + } p_msg->only_update_did = only_update_did; //start sent the msg to the bta system control module bta_sys_sendmsg(p_msg); @@ -3298,7 +3259,7 @@ void BTA_DmBleGapEnableMonitorAdv(UINT8 enable) #endif // #if (BLE_FEAT_ADV_MONITOR == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void BTA_DmBleGapIsoBigCreate(tBTA_DM_BLE_BIG_CREATE_PARAMS *p_big_creat_param) { tBTA_DM_API_BIG_CREATE *p_msg; @@ -3373,7 +3334,7 @@ void BTA_DmBleGapIsoBigTerminate(tBTA_DM_BLE_BIG_TERMINATE_PARAMS *p_big_termina APPL_TRACE_ERROR("%s malloc failed", __func__); } } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) void BTA_DmBleGapIsoBigSyncCreate(tBTA_DM_BLE_BIG_SYNC_CREATE_PARAMS *p_big_sync_param) @@ -3633,7 +3594,7 @@ void BTA_DmBleCteSetConnectionlessTransParams(uint8_t adv_handle, uint8_t cte_le p_buf->cte_count = cte_count; p_buf->switching_pattern_len = switching_pattern_len; p_buf->antenna_ids = (switching_pattern_len != 0) ? (UINT8 *)(p_buf + 1) : NULL; - if (switching_pattern_len) { + if (switching_pattern_len && antenna_ids) { memcpy(p_buf->antenna_ids, antenna_ids, switching_pattern_len); } //start sent the msg to the bta system control module @@ -3677,7 +3638,7 @@ void BTA_DmBleCteSetConnectionlessIqSamplingEnable(uint16_t sync_handle, uint8_t p_buf->max_sampled_ctes = max_sampled_ctes; p_buf->switching_pattern_len = switching_pattern_len; p_buf->antenna_ids = (switching_pattern_len != 0) ? (UINT8 *)(p_buf + 1) : NULL; - if (switching_pattern_len) { + if (switching_pattern_len && ant_ids) { memcpy(p_buf->antenna_ids, ant_ids, switching_pattern_len); } // start sent the msg to the bta system control module @@ -3704,7 +3665,7 @@ void BTA_DmBleCteSetConnectionReceiveParams(uint16_t conn_handle, uint8_t sampli p_buf->slot_dur = slot_dur; p_buf->switching_pattern_len = switching_pattern_len; p_buf->antenna_ids = (switching_pattern_len != 0) ? (UINT8 *)(p_buf + 1) : NULL; - if (switching_pattern_len) { + if (switching_pattern_len && ant_ids) { memcpy(p_buf->antenna_ids, ant_ids, switching_pattern_len); } // start sent the msg to the bta system control module @@ -3727,7 +3688,7 @@ void BTA_DmBleCteSetConnectionTransParams(uint16_t conn_handle, uint8_t cte_type p_buf->cte_types = cte_types; p_buf->switching_pattern_len = switching_pattern_len; p_buf->antenna_ids = (switching_pattern_len != 0) ? (UINT8 *)(p_buf + 1) : NULL; - if (switching_pattern_len) { + if (switching_pattern_len && ant_ids) { memcpy(p_buf->antenna_ids, ant_ids, switching_pattern_len); } // start sent the msg to the bta system control module diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c index 5284d9a6b8b..5b7461120df 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c @@ -158,7 +158,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = { bta_dm_ble_set_key_material, /* BTA_DM_API_KEY_MATERIAL_EVT */ #endif #if (BLE_42_ADV_EN == TRUE) - bta_dm_ble_set_adv_params_all, /* BTA_DM_API_BLE_ADV_PARAM_All_EVT */ + bta_dm_ble_start_adv_with_params, /* BTA_DM_API_BLE_ADV_START_WITH_PARAMS_EVT */ bta_dm_ble_set_adv_config, /* BTA_DM_API_BLE_SET_ADV_CONFIG_EVT */ /* New function to allow set raw adv data to HCI */ @@ -254,11 +254,11 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = { bta_dm_read_ble_channel_map, /* BTA_DM_API_BLE_READ_CH_MAP_EVT */ #endif #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) bta_dm_ble_big_create, /* BTA_DM_API_ISO_BIG_CREATE_EVT */ bta_dm_ble_big_create_test, /* BTA_DM_API_ISO_BIG_CREATE_TEST_EVT */ bta_dm_ble_big_terminate, /* BTA_DM_API_ISO_BIG_TERMINATE_EVT */ -#endif// #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif// #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) bta_dm_ble_big_sync_create, /* BTA_DM_API_ISO_BIG_SYNC_CREATE_EVT */ bta_dm_ble_big_sync_terminate, /* BTA_DM_API_ISO_BIG_SYNC_TERMINATE_EVT */ diff --git a/components/bt/host/bluedroid/bta/dm/include/bta_dm_gap.h b/components/bt/host/bluedroid/bta/dm/include/bta_dm_gap.h new file mode 100644 index 00000000000..de3d48033bb --- /dev/null +++ b/components/bt/host/bluedroid/bta/dm/include/bta_dm_gap.h @@ -0,0 +1,119 @@ +/****************************************************************************** + * + * Copyright (C) 2003-2012 Broadcom Corporation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + ******************************************************************************/ + +/****************************************************************************** + * + * This is the private interface file for the BTA device manager. + * + ******************************************************************************/ +#ifndef BTA_DM_GAP_H +#define BTA_DM_GAP_H + +#include +#include "common/bt_target.h" + +#if BLE_INCLUDED == TRUE +typedef uint8_t tBTM_BLE_LEGACY_GAP_EVENT; + +typedef struct { + uint8_t status; + uint16_t rx_len; + uint16_t tx_len; +} tBTM_BLE_DATA_LEN_UP_EVT; + +typedef struct { + uint8_t status; + BD_ADDR remote_bd_addr; + uint16_t min_conn_int; + uint16_t max_conn_int; + uint16_t conn_int; + uint16_t slave_latency; + uint16_t supervision_tout; +} tBTM_BLE_CONN_PRAMS_UPDATE_EVT; + +typedef struct { + uint8_t status; + uint8_t operation; +} tBTM_BLE_WHITE_LIST_UPDATE_EVT; + +typedef struct { + tBTM_STATUS status; + uint8_t hci_status; + uint8_t channel_map[5]; + BD_ADDR rem_bda; +} tBTM_BLE_CH_MAP_EVT; + +typedef struct { + uint8_t status; + uint8_t subcode; + uint32_t length; + uint8_t *device_info; +} tBTM_BLE_EXCEPTION_LIST_UPDATE_EVT; + +typedef struct { + tBTM_STATUS status; + uint8_t hci_status; +} tBTM_BLE_SET_CHANNELS_EVT; + +typedef union { + uint8_t status; + tBTM_BLE_DATA_LEN_UP_EVT data_length_params; + tBTM_BLE_CONN_PRAMS_UPDATE_EVT conn_params_update; + tBTM_BLE_WHITE_LIST_UPDATE_EVT white_list_update; + tBTM_BLE_CH_MAP_EVT ch_map_results; + tBTM_BLE_EXCEPTION_LIST_UPDATE_EVT exception_list_up; + tBTM_BLE_SET_CHANNELS_EVT set_channels; +} tBTM_BLE_LEGACY_GAP_CB_PARAMS; + +#define BTM_BLE_LEGACY_GAP_ADV_START_COMPLETE_EVT 0x01 +#define BTM_BLE_LEGACY_GAP_ADV_STOP_COMPLETE_EVT 0x02 +#define BTM_BLE_LEGACY_GAP_ADV_DATA_SET_COMPLETE_EVT 0x03 +#define BTM_BLE_LEGACY_GAP_ADV_RAW_SET_COMPLETE_EVT 0x04 +#define BTM_BLE_LEGACY_GAP_SCAN_RSP_SET_COMPLETE_EVT 0x05 +#define BTM_BLE_LEGACY_GAP_RSP_RAW_SET_COMPLETE_EVT 0x06 +#define BTM_BLE_LEGACY_GAP_SCAN_PARAMS_SET_COMPLETE_EVT 0x07 +#define BTM_BLE_LEGACY_GAP_SCAN_START_COMPLETE_EVT 0x08 +#define BTM_BLE_LEGACY_GAP_SCAN_STOP_COMPLETE_EVT 0x09 +#define BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT 0x0A +#define BTM_BLE_LEGACY_GAP_CONNECTION_PARAMS_UPDATE_EVT 0x0B +#define BTM_BLE_LEGACY_GAP_SET_RANDOM_ADDR_EVT 0x0C +#define BTM_BLE_LEGACY_GAP_RPA_TIMEOUT_EVT 0x0D +#define BTM_BLE_LEGACY_GAP_ADD_DEV_TO_RPA_LIST_EVT 0x0E +#define BTM_BLE_LEGACY_GAP_SET_PRIVACY_EVT 0x0F +#define BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT 0x10 +#define BTM_BLE_LEGACY_GAP_READ_CHANNEL_MAP_EVT 0x11 +#define BTM_BLE_LEGACY_GAP_EXCEPTION_LIST_UPDATE_EVT 0x12 +#define BTM_BLE_LEGACY_GAP_CLEAR_ADV_COMPLETE_EVT 0x13 +#define BTM_BLE_LEGACY_GAP_SET_CSA_SUPPORT_COMPLETE_EVT 0x14 +#define BTM_BLE_LEGACY_GAP_SET_VENDOR_EVT_MASK_COMPLETE_EVT 0x15 +#define BTM_BLE_LEGACY_GAP_SET_CHANNELS_COMPLETE_EVT 0x16 +#define BTM_BLE_LEGACY_GAP_SET_PRIVACY_MODE_COMPLETE_EVT 0x17 +// BTM_BLE_LEGACY_GAP_MAX_EVT should not be modified +#define BTM_BLE_LEGACY_GAP_MAX_EVT 0x40 + +typedef void (*tBTM_BLE_LEGACY_GAP_CBACK)(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params); +void BTM_BleLegacyGapRegisterCallback(tBTM_BLE_LEGACY_GAP_CBACK cb); +void BTM_LegacyBleCallbackTrigger(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params); + +/* Arm legacy GAP one-shot: next HCI complete for this event may invoke the registered callback once. */ +void BTM_BleLegacyGapOneshotArm(tBTM_BLE_LEGACY_GAP_EVENT event); +/* If armed, disarm and call BTM_LegacyBleCallbackTrigger; otherwise no-op. */ +void BTM_BleLegacyGapOneshotFireIfArmed(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params); +#endif // #if BLE_INCLUDED == TRUE + +#endif /* BTA_DM_GAP_H */ diff --git a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h index d57f847843e..5a759a7417a 100644 --- a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h +++ b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h @@ -45,7 +45,8 @@ #define BTA_DM_MSG_LEN 50 -#define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id)) +/* Use 1ULL to avoid UB: 1 << 32 is undefined when int is 32-bit (C11 §6.5.7) */ +#define BTA_SERVICE_ID_TO_SERVICE_MASK(id) ((UINT32)(1ULL << (id))) /* DM events */ enum { @@ -151,7 +152,7 @@ enum { /*******This event added by Yulong at 2016/10/20 to support setting the ble advertising param by the APP******/ #if (BLE_42_ADV_EN == TRUE) - BTA_DM_API_BLE_ADV_PARAM_All_EVT, + BTA_DM_API_BLE_ADV_START_WITH_PARAMS_EVT, BTA_DM_API_BLE_SET_ADV_CONFIG_EVT, /* Add for set raw advertising data */ BTA_DM_API_BLE_SET_ADV_CONFIG_RAW_EVT, @@ -247,11 +248,11 @@ enum { BTA_DM_API_BLE_READ_CH_MAP_EVT, #endif #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) BTA_DM_API_ISO_BIG_CREATE_EVT, BTA_DM_API_ISO_BIG_CREATE_TEST_EVT, BTA_DM_API_ISO_BIG_TERMINATE_EVT, -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) BTA_DM_API_ISO_BIG_SYNC_CREATE_EVT, BTA_DM_API_ISO_BIG_SYNC_TERMINATE_EVT, @@ -442,7 +443,6 @@ typedef struct { typedef struct { BT_HDR hdr; AFH_CHANNELS channels; - tBTA_CMPL_CB *set_channels_cb; }tBTA_DM_API_BLE_SET_CHANNELS; typedef struct { @@ -450,7 +450,6 @@ typedef struct { BOOLEAN add_remove; BD_ADDR remote_addr; tBLE_ADDR_TYPE addr_type; - tBTA_UPDATE_WHITELIST_CBACK *update_wl_cb; }tBTA_DM_API_UPDATE_WHITE_LIST; #if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) @@ -459,7 +458,6 @@ typedef struct { UINT8 subcode; UINT32 type; BD_ADDR device_info; - tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK *exceptional_list_cb; }tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST; #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) @@ -510,7 +508,6 @@ typedef struct { typedef struct { BT_HDR hdr; BD_ADDR remote_addr; - tBTA_CMPL_CB *read_ch_map_cb; } tBTA_DM_API_READ_CH_MAP; /* data type for BTA_DM_API_SET_VISIBILITY_EVT */ @@ -833,7 +830,6 @@ typedef struct { typedef struct { BT_HDR hdr; BOOLEAN privacy_enable; - tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback; } tBTA_DM_API_LOCAL_PRIVACY; typedef struct { @@ -849,16 +845,6 @@ typedef struct { } tBTA_DM_API_KEY_MATERIAL; #endif -/* set scan parameter for BLE connections */ -typedef struct { - BT_HDR hdr; - tBTA_GATTC_IF client_if; - UINT32 scan_int; - UINT32 scan_window; - tBLE_SCAN_MODE scan_mode; - tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback; -} tBTA_DM_API_BLE_SCAN_PARAMS; - typedef struct { BT_HDR hdr; tBTA_GATTC_IF client_if; @@ -868,19 +854,12 @@ typedef struct { UINT8 addr_type_own; UINT8 scan_duplicate_filter; UINT8 scan_filter_policy; - tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback; } tBTA_DM_API_BLE_SCAN_FILTER_PARAMS; /* Data type for start/stop observe */ typedef struct { BT_HDR hdr; - BOOLEAN start; - UINT32 duration; - tBTA_DM_SEARCH_CBACK *p_cback; - tBTA_START_STOP_SCAN_CMPL_CBACK *p_start_scan_cback; - tBTA_START_STOP_SCAN_CMPL_CBACK *p_stop_scan_cback; - tBTA_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback; -} tBTA_DM_API_BLE_OBSERVE; +} tBTA_DM_API_BLE_ADVACTION; /* Data type for start/stop scan */ typedef struct { @@ -888,16 +867,12 @@ typedef struct { BOOLEAN start; UINT32 duration; tBTA_DM_SEARCH_CBACK *p_cback; - tBTA_START_STOP_SCAN_CMPL_CBACK *p_start_scan_cback; - tBTA_START_STOP_SCAN_CMPL_CBACK *p_stop_scan_cback; - tBTA_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback; } tBTA_DM_API_BLE_SCAN; typedef struct { BT_HDR hdr; BD_ADDR remote_bda; UINT16 tx_data_length; - tBTA_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback; } tBTA_DM_API_BLE_SET_DATA_LENGTH; /* set the address for BLE device @@ -906,7 +881,6 @@ typedef struct { BT_HDR hdr; tBLE_ADDR_TYPE addr_type; BD_ADDR address; - tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback; } tBTA_DM_APT_SET_DEV_ADDR; typedef struct { @@ -916,7 +890,6 @@ typedef struct { typedef struct { BT_HDR hdr; UINT16 rpa_timeout; - tBTA_SET_RPA_TIMEOUT_CMPL_CBACK *p_set_rpa_timeout_cback; } tBTA_DM_API_SET_RPA_TIMEOUT; typedef struct { @@ -924,7 +897,6 @@ typedef struct { esp_bd_addr_t addr; // Bluetooth device address UINT8 addr_type; // Type of the address UINT8 irk[PEER_IRK_LEN]; // Identity Resolving Key (IRK) - tBTA_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *p_add_dev_to_resolving_list_callback; // Callback function pointer } tBTA_DM_API_ADD_DEV_TO_RESOLVING_LIST; /* set adv parameter for BLE advertising */ @@ -937,7 +909,6 @@ typedef struct { tBTM_BLE_ADV_CHNL_MAP channel_map; tBTM_BLE_AFP adv_filter_policy; tBLE_BD_ADDR *p_dir_bda; - tBTA_START_ADV_CMPL_CBACK *p_start_adv_cback; } tBTA_DM_API_BLE_ADV_PARAMS_ALL; @@ -951,7 +922,6 @@ typedef struct { BT_HDR hdr; UINT32 data_mask; tBTA_BLE_ADV_DATA *p_adv_cfg; - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback; } tBTA_DM_API_SET_ADV_CONFIG; /* raw scan response and raw advertising data use @@ -960,7 +930,6 @@ typedef struct { BT_HDR hdr; UINT8 *p_raw_adv; UINT32 raw_adv_len; - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback; } tBTA_DM_API_SET_ADV_CONFIG_RAW; typedef struct { @@ -991,7 +960,6 @@ typedef struct { typedef struct { BT_HDR hdr; - tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback; } tBTA_DM_API_CLEAR_ADV; typedef struct { @@ -999,19 +967,16 @@ typedef struct { tBLE_ADDR_TYPE addr_type; BD_ADDR addr; UINT8 privacy_mode; - tBTA_SET_PRIVACY_MODE_CMPL_CBACK *p_cback; } tBTA_DM_API_SET_PRIVACY_MODE; typedef struct { BT_HDR hdr; UINT8 csa_select; - tBTA_SET_CSA_SUPPORT_CMPL_CBACK *p_cback; } tBTA_DM_API_BLE_SET_CSA_SUPPORT; typedef struct { BT_HDR hdr; UINT32 evt_mask; - tBTA_SET_VENDOR_EVT_MASK_CBACK *p_cback; } tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK; #if (BLE_FEAT_POWER_CONTROL_EN == TRUE) @@ -1469,7 +1434,7 @@ typedef struct { #endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) typedef struct { BT_HDR hdr; tBTA_DM_BLE_BIG_CREATE_PARAMS big_creat_param; @@ -1482,7 +1447,7 @@ typedef struct { BT_HDR hdr; tBTA_DM_BLE_BIG_TERMINATE_PARAMS big_terminate_param; } tBTA_DM_API_BIG_TERMINATE; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) typedef struct { BT_HDR hdr; @@ -1779,7 +1744,7 @@ typedef union { tBTA_DM_API_BLE_SET_BG_CONN_TYPE ble_set_bd_conn_type; tBTA_DM_API_BLE_CONN_PARAMS ble_set_conn_params; tBTA_DM_API_BLE_SCAN_FILTER_PARAMS ble_set_scan_fil_params; - tBTA_DM_API_BLE_OBSERVE ble_observe; + tBTA_DM_API_BLE_ADVACTION ble_adv_action; tBTA_DM_API_BLE_SCAN ble_scan; tBTA_DM_API_ENABLE_PRIVACY ble_remote_privacy; tBTA_DM_API_LOCAL_PRIVACY ble_local_privacy; @@ -1859,11 +1824,11 @@ typedef union { tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK ble_set_vendor_evt_mask; #endif #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) tBTA_DM_API_BIG_CREATE big_creat; tBTA_DM_API_BIG_CREATE_TEST big_creat_test; tBTA_DM_API_BIG_TERMINATE big_terminate; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) tBTA_DM_API_BIG_SYNC_CREATE big_sync; tBTA_DM_API_BIG_SYNC_TERMINATE big_sync_terminate; @@ -2360,7 +2325,7 @@ extern void bta_dm_ble_config_local_icon (tBTA_DM_MSG *p_data); #if (BT_GATTS_KEY_MATERIAL_CHAR == TRUE) extern void bta_dm_ble_set_key_material (tBTA_DM_MSG *p_data); #endif -extern void bta_dm_ble_set_adv_params_all(tBTA_DM_MSG *p_data); +extern void bta_dm_ble_start_adv_with_params(tBTA_DM_MSG *p_data); extern void bta_dm_ble_set_adv_config (tBTA_DM_MSG *p_data); extern void bta_dm_ble_set_adv_config_raw (tBTA_DM_MSG *p_data); extern void bta_dm_ble_set_scan_rsp (tBTA_DM_MSG *p_data); @@ -2528,11 +2493,11 @@ extern void bta_dm_ble_gap_enable_monitor_adv(tBTA_DM_MSG *p_data); #endif // #if (BLE_FEAT_ADV_MONITOR == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) extern void bta_dm_ble_big_create(tBTA_DM_MSG *p_data); extern void bta_dm_ble_big_create_test(tBTA_DM_MSG *p_data); extern void bta_dm_ble_big_terminate(tBTA_DM_MSG *p_data); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) extern void bta_dm_ble_big_sync_create(tBTA_DM_MSG *p_data); extern void bta_dm_ble_big_sync_terminate(tBTA_DM_MSG *p_data); diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatt_common.c b/components/bt/host/bluedroid/bta/gatt/bta_gatt_common.c index 81cee87767b..2b8ecd72c9f 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatt_common.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatt_common.c @@ -16,6 +16,10 @@ void BTA_GATT_SetLocalMTU(uint16_t mtu) { + if (mtu < GATT_DEF_BLE_MTU_SIZE || mtu > GATT_MAX_MTU_SIZE) { + APPL_TRACE_ERROR("%s: invalid mtu=%u", __func__, mtu); + return; + } gatt_set_local_mtu(mtu); } diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c index c3406f6a93a..9aa81e375e2 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c @@ -38,10 +38,6 @@ #include "bta_hh_int.h" #include "btm_int.h" -#if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE) -#include "bta_hh_int.h" -#endif - // #include "btif/include/btif_debug_conn.h" #include @@ -71,7 +67,7 @@ static void bta_gattc_req_cback (UINT16 conn_id, UINT32 trans_id, tGATTS_REQ_TYP static tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_id, BD_ADDR remote_bda); extern void btc_gattc_congest_callback(tBTA_GATTC *param); -extern uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb); +extern uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type); static const tGATT_CBACK bta_gattc_cl_cback = { bta_gattc_conn_cback, @@ -290,12 +286,21 @@ void bta_gattc_deregister(tBTA_GATTC_CB *p_cb, tBTA_GATTC_RCB *p_clreg) /* remove bg connection associated with this rcb */ for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i ++) { if (p_cb->bg_track[i].in_use) { - if (p_cb->bg_track[i].cif_mask & (1 << (p_clreg->client_if - 1))) { - bta_gattc_mark_bg_conn(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE, FALSE); - GATT_CancelConnect(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE); + if (p_cb->bg_track[i].cif_mask & BTA_GATTC_CIF_MASK_BIT(p_clreg->client_if)) { + /* bta_gattc_mark_bg_conn is called to remove the application's bit from the mask. + If this was the last application interested in the device, + bta_gattc_mark_bg_conn zeroes out the entire track entry using memset + */ + BD_ADDR remote_bda; + bdcpy(remote_bda, p_cb->bg_track[i].remote_bda); + bta_gattc_mark_bg_conn(p_clreg->client_if, remote_bda, FALSE, FALSE); + GATT_CancelConnect(p_clreg->client_if, remote_bda, FALSE); } - if (p_cb->bg_track[i].cif_adv_mask & (1 << (p_clreg->client_if - 1))) { - bta_gattc_mark_bg_conn(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE, TRUE); + if (p_cb->bg_track[i].cif_adv_mask & BTA_GATTC_CIF_MASK_BIT(p_clreg->client_if)) { + BD_ADDR remote_bda_adv; + bdcpy(remote_bda_adv, p_cb->bg_track[i].remote_bda); + bta_gattc_mark_bg_conn(p_clreg->client_if, remote_bda_adv, FALSE, TRUE); + GATT_CancelConnect(p_clreg->client_if, remote_bda_adv, FALSE); } } } @@ -340,7 +345,7 @@ void bta_gattc_process_api_open (tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg) if (p_clreg != NULL) { if (p_msg->api_conn.own_addr_type <= BLE_ADDR_TYPE_MAX) { // update own address type for creating connection - BTM_BleUpdateOwnType(&p_msg->api_conn.own_addr_type, NULL); + BTM_BleUpdateOwnType(&p_msg->api_conn.own_addr_type); } if (p_msg->api_conn.is_direct) { if ((p_clcb = bta_gattc_find_alloc_clcb(p_msg->api_conn.client_if, @@ -461,28 +466,6 @@ void bta_gattc_cancel_open_error(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_dat } } -/******************************************************************************* -** -** Function bta_gattc_open_error -** -** Description -** -** Returns void -** -*******************************************************************************/ -void bta_gattc_open_error(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) -{ - UNUSED(p_data); - - APPL_TRACE_ERROR("Connection already opened. wrong state"); - - bta_gattc_send_open_cback(p_clcb->p_rcb, - BTA_GATT_OK, - p_clcb->bda, - p_clcb->bta_conn_id, - p_clcb->transport, - 0); -} /******************************************************************************* ** ** Function bta_gattc_open_fail @@ -734,6 +717,18 @@ void bta_gattc_cancel_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) { tBTA_GATTC_IF gatt_if; + if (p_clcb->p_srcb == NULL) { + APPL_TRACE_ERROR("%s, p_clcb->p_srcb is NULL", __func__); + if (p_clcb->p_rcb) { + bta_gattc_send_open_cback(p_clcb->p_rcb, + BTA_GATT_ERROR, + p_clcb->bda, + p_clcb->bta_conn_id, + p_clcb->transport, + GATT_DEF_BLE_MTU_SIZE); + } + return; + } APPL_TRACE_DEBUG("bta_gattc_conn server cache state=%d", p_clcb->p_srcb->state); if (p_data != NULL) { @@ -882,6 +877,10 @@ void bta_gattc_close_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) *******************************************************************************/ void bta_gattc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) { + if (!p_clcb || !p_clcb->p_rcb) { + APPL_TRACE_ERROR("%s, p_clcb or p_clcb->p_rcb is NULL", __func__); + return; + } tBTA_GATTC_CBACK *p_cback = p_clcb->p_rcb->p_cback; tBTA_GATTC_RCB *p_clreg = p_clcb->p_rcb; tBTA_GATTC cb_data; @@ -1117,6 +1116,11 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) APPL_TRACE_DEBUG("bta_gattc_disc_cmpl conn_id=%d, status = %d", p_clcb->bta_conn_id, p_clcb->status); + if (p_clcb->p_srcb == NULL) { + APPL_TRACE_ERROR("%s, p_clcb->p_srcb is NULL", __func__); + return; + } + p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE; p_clcb->disc_active = FALSE; @@ -1235,16 +1239,13 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) if (bta_gattc_enqueue(p_clcb, p_data)) { memset(&read_param, 0, sizeof(tGATT_READ_PARAM)); - if (status == BTA_GATT_OK) { - read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr; - read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req; - memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles, - sizeof(UINT16) * p_data->api_read_multi.num_attr); + read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr; + read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req; + memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles, + sizeof(UINT16) * p_data->api_read_multi.num_attr); - status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE, &read_param); - } + status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE, &read_param); - /* read fail */ if (status != BTA_GATT_OK) { bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL); } @@ -1266,16 +1267,13 @@ void bta_gattc_read_multi_var(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) if (bta_gattc_enqueue(p_clcb, p_data)) { memset(&read_param, 0, sizeof(tGATT_READ_PARAM)); - if (status == BTA_GATT_OK) { - read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr; - read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req; - memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles, - sizeof(UINT16) * p_data->api_read_multi.num_attr); + read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr; + read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req; + memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles, + sizeof(UINT16) * p_data->api_read_multi.num_attr); - status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE_VAR, &read_param); - } + status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE_VAR, &read_param); - /* read fail */ if (status != BTA_GATT_OK) { bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL); } @@ -1385,6 +1383,11 @@ void bta_gattc_read_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data) tBTA_GATTC cb_data; tBTA_GATT_UNFMT read_value; + if (p_clcb->p_q_cmd == NULL) { + APPL_TRACE_ERROR("%s, p_clcb->p_q_cmd is NULL", __func__); + return; + } + memset(&cb_data, 0, sizeof(tBTA_GATTC)); memset(&read_value, 0, sizeof(tBTA_GATT_UNFMT)); @@ -1427,6 +1430,18 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data) { tBTA_GATTC cb_data = {0}; UINT8 event; + if (p_data->p_cmpl == NULL) { + APPL_TRACE_ERROR("%s, p_data->p_cmpl is NULL", __func__); + UINT16 handle = p_clcb->p_q_cmd->api_write.handle; + tBTA_GATTC_EVT cmpl_evt = p_clcb->p_q_cmd->api_write.cmpl_evt; + bta_gattc_free_command_data(p_clcb); + bta_gattc_pop_command_to_send(p_clcb); + cb_data.write.status = BTA_GATT_ERROR; + cb_data.write.handle = handle; + cb_data.write.conn_id = p_clcb->bta_conn_id; + ( *p_clcb->p_rcb->p_cback)(cmpl_evt, (tBTA_GATTC *)&cb_data); + return; + } tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find(p_clcb->bda); memset(&cb_data, 0, sizeof(tBTA_GATTC)); @@ -1435,6 +1450,17 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data) cb_data.write.handle = p_data->p_cmpl->att_value.handle; if (p_clcb->p_q_cmd->api_write.hdr.event == BTA_GATTC_API_WRITE_EVT && p_clcb->p_q_cmd->api_write.write_type == BTA_GATTC_WRITE_PREPARE) { + // Check if the parameters are valid + // should not happen, but just in case + if (p_clcb->p_q_cmd->api_write.p_value == NULL) { + APPL_TRACE_ERROR("%s, p_clcb->p_q_cmd->api_write.p_value is NULL", __func__); + bta_gattc_free_command_data(p_clcb); + bta_gattc_pop_command_to_send(p_clcb); + cb_data.write.status = BTA_GATT_ERROR; + cb_data.write.conn_id = p_clcb->bta_conn_id; + ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_PREP_WRITE_EVT, (tBTA_GATTC *)&cb_data); + return; + } // Should check the value received from the peer device is correct or not. if (memcmp(p_clcb->p_q_cmd->api_write.p_value, p_data->p_cmpl->att_value.value, p_data->p_cmpl->att_value.len) != 0) { @@ -1530,6 +1556,13 @@ void bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data) APPL_TRACE_DEBUG("bta_gattc_op_cmpl op = %d", op); + // Check if the operation is valid + // should not happen, but just in case + if (op > GATTC_OPTYPE_INDICATION) { + APPL_TRACE_ERROR("unexpected operation, ignored"); + return; + } + if (op == GATTC_OPTYPE_INDICATION || op == GATTC_OPTYPE_NOTIFICATION) { APPL_TRACE_ERROR("unexpected operation, ignored"); } else if (op >= GATTC_OPTYPE_READ) { @@ -1914,49 +1947,30 @@ void bta_gattc_process_api_cache_assoc(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m { tBTA_GATTC gattc_cb = {0}; gattc_cb.set_assoc.client_if = p_msg->api_assoc.client_if; + gattc_cb.set_assoc.status = BTA_GATT_OK; BOOLEAN state = FALSE; tBTA_GATTC_CLCB *p_assoc_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_assoc.client_if, p_msg->api_assoc.assoc_addr, BTA_TRANSPORT_LE); tBTA_GATTC_RCB *p_clrcb = bta_gattc_cl_get_regcb(p_msg->api_assoc.client_if); - if (p_assoc_clcb != NULL) { - if (p_assoc_clcb->state == BTA_GATTC_CONN_ST || p_assoc_clcb->state == BTA_GATTC_DISCOVER_ST) { - gattc_cb.set_assoc.status = BTA_GATT_BUSY; - if (p_clrcb != NULL) { - (*p_clrcb->p_cback)(BTA_GATTC_ASSOC_EVT, &gattc_cb); - return; - } - } - } - if (p_msg->api_assoc.is_assoc) { - if ((state = bta_gattc_co_cache_append_assoc_addr(p_msg->api_assoc.src_addr, p_msg->api_assoc.assoc_addr)) == TRUE) { - gattc_cb.set_assoc.status = BTA_GATT_OK; - - } else { + if (p_assoc_clcb != NULL && + (p_assoc_clcb->state == BTA_GATTC_CONN_ST || p_assoc_clcb->state == BTA_GATTC_DISCOVER_ST)) { + gattc_cb.set_assoc.status = BTA_GATT_BUSY; + } else if (p_msg->api_assoc.is_assoc) { + state = bta_gattc_co_cache_append_assoc_addr(p_msg->api_assoc.src_addr, p_msg->api_assoc.assoc_addr); + if (!state) { gattc_cb.set_assoc.status = BTA_GATT_ERROR; - if (p_clrcb != NULL) { - (*p_clrcb->p_cback)(BTA_GATTC_ASSOC_EVT, &gattc_cb); - return; - } } } else { - if (( state = bta_gattc_co_cache_remove_assoc_addr(p_msg->api_assoc.src_addr, p_msg->api_assoc.assoc_addr)) == TRUE) { - gattc_cb.set_assoc.status = BTA_GATT_OK; - } else { + state = bta_gattc_co_cache_remove_assoc_addr(p_msg->api_assoc.src_addr, p_msg->api_assoc.assoc_addr); + if (!state) { gattc_cb.set_assoc.status = BTA_GATT_ERROR; - if (p_clrcb != NULL) { - (*p_clrcb->p_cback)(BTA_GATTC_ASSOC_EVT, &gattc_cb); - return; - } } } - if (p_clrcb != NULL) { + if (p_clrcb != NULL && p_clrcb->p_cback != NULL) { (*p_clrcb->p_cback)(BTA_GATTC_ASSOC_EVT, &gattc_cb); } - - return; - } void bta_gattc_process_api_cache_get_addr_list(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg) { @@ -1978,7 +1992,7 @@ void bta_gattc_process_api_cache_get_addr_list(tBTA_GATTC_CB *p_cb, tBTA_GATTC_D gattc_cb.get_addr_list.status = BTA_GATT_NOT_FOUND; } - if (p_clrcb != NULL) { + if (p_clrcb != NULL && p_clrcb->p_cback != NULL) { (* p_clrcb->p_cback)(BTA_GATTC_GET_ADDR_LIST_EVT, &gattc_cb); } @@ -2384,7 +2398,7 @@ tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_ tBTA_GATTC_SERVICE *p_service = NULL; tBTA_GATTC_CHARACTERISTIC *p_char = NULL; tBTA_GATTC_DESCRIPTOR *p_desc = NULL; - tBTA_GATTC_FIND_SERVICE_CB result; + tBTA_GATTC_FIND_SERVICE_CB result = SERVICE_CHANGE_CACHE_NOT_FOUND; BOOLEAN gatt_cache_found = FALSE; BOOLEAN gatt_service_found = FALSE; BOOLEAN gatt_service_change_found = FALSE; diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c index 69738647ba5..29df6772748 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c @@ -151,6 +151,7 @@ void BTA_GATTC_Enh_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_T tBTA_GATTC_API_OPEN *p_buf; if ((p_buf = (tBTA_GATTC_API_OPEN *) osi_malloc(sizeof(tBTA_GATTC_API_OPEN))) != NULL) { + memset(p_buf, 0, sizeof(tBTA_GATTC_API_OPEN)); p_buf->hdr.event = BTA_GATTC_API_OPEN_EVT; p_buf->client_if = client_if; @@ -365,7 +366,7 @@ void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid, void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_ALL_CHAR, 0, NULL, @@ -380,7 +381,7 @@ void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_ALL_DESCRI, char_handle, NULL, @@ -395,7 +396,7 @@ void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle, void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_CHAR_BY_UUID, 0, NULL, @@ -411,7 +412,7 @@ void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t en tBT_UUID char_uuid, tBT_UUID descr_uuid, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_DESCRI_BY_UUID, 0, NULL, @@ -426,7 +427,7 @@ void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t en void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_DESCRI_BY_HANDLE, char_handle, NULL, @@ -441,7 +442,7 @@ void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count) { - bta_gattc_get_db_with_opration(conn_id, + bta_gattc_get_db_with_operation(conn_id, GATT_OP_GET_INCLUDE_SVC, 0, incl_uuid, @@ -528,9 +529,8 @@ void BTA_GATTC_ReadCharacteristic(UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_ void BTA_GATTC_ReadCharDescr (UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_REQ auth_req) { tBTA_GATTC_API_READ *p_buf; - UINT16 len = (UINT16)(sizeof(tBTA_GATT_ID) + sizeof(tBTA_GATTC_API_READ)); - if ((p_buf = (tBTA_GATTC_API_READ *) osi_malloc(len)) != NULL) { + if ((p_buf = (tBTA_GATTC_API_READ *) osi_malloc(sizeof(tBTA_GATTC_API_READ))) != NULL) { memset(p_buf, 0, sizeof(tBTA_GATTC_API_READ)); p_buf->hdr.event = BTA_GATTC_API_READ_EVT; @@ -560,6 +560,7 @@ void BTA_GATTC_ReadCharDescr (UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_REQ void BTA_GATTC_ReadMultiple(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi, tBTA_GATT_AUTH_REQ auth_req) { + // p_read_multi should not be NULL tBTA_GATTC_API_READ_MULTI *p_buf; //tBTA_GATTC_API_READ_MULTI *p_value; UINT16 len = (UINT16)(sizeof(tBTA_GATTC_API_READ_MULTI)); @@ -921,7 +922,7 @@ tBTA_GATT_STATUS BTA_GATTC_RegisterForNotifications (tBTA_GATTC_IF client_if, if (!handle) { - APPL_TRACE_ERROR("deregistration failed, handle is 0"); + APPL_TRACE_ERROR("registration failed, handle is 0"); return status; } @@ -1117,10 +1118,15 @@ typedef struct { } uuid; } __attribute__((packed)) tAPP_UUID; -uint8_t BTA_GATTC_Discover(uint8_t gatt_if, uint16_t conn_id, void *uuid, uint8_t disc_type, uint16_t s_handle, uint16_t e_handle) +int BTA_GATTC_Discover(uint8_t gatt_if, uint16_t conn_id, void *uuid, uint8_t disc_type, uint16_t s_handle, uint16_t e_handle) { tGATT_STATUS status; tGATT_DISC_PARAM param; + + if (uuid == NULL && disc_type == GATT_DISC_SRVC_BY_UUID) { + APPL_TRACE_ERROR("%s invalid parameters", __func__); + return -1; + } tAPP_UUID *app_uuid = (tAPP_UUID *)uuid; conn_id = (UINT16)((((UINT8)conn_id) << 8) | gatt_if); @@ -1144,6 +1150,7 @@ uint8_t BTA_GATTC_Discover(uint8_t gatt_if, uint16_t conn_id, void *uuid, uint8_ memcpy(param.service.uu.uuid128, app_uuid->uuid.uuid128, LEN_UUID_128); } else { APPL_TRACE_ERROR("%s invalid uuid len %u", __func__, app_uuid->len); + return -1; } } diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c index 7af5e6beeed..aebffce50a8 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c @@ -40,6 +40,7 @@ #include "stack/l2c_api.h" #include "btm_int.h" #include "errno.h" +#include "gatt_int.h" // #include "osi/include/log.h" @@ -287,6 +288,12 @@ static tBTA_GATT_STATUS bta_gattc_add_srvc_to_cache(tBTA_GATTC_SERV *p_srvc_cb, if(!p_srvc_cb->p_srvc_cache) { APPL_TRACE_WARNING("%s(), no resource.", __func__); + if (p_new_srvc->characteristics) { + list_free(p_new_srvc->characteristics); + } + if (p_new_srvc->included_svc) { + list_free(p_new_srvc->included_svc); + } osi_free(p_new_srvc); return BTA_GATT_NO_RESOURCES; } @@ -336,7 +343,14 @@ static tBTA_GATT_STATUS bta_gattc_add_char_to_cache(tBTA_GATTC_SERV *p_srvc_cb, memcpy(&characteristic->uuid, p_uuid, sizeof(tBT_UUID)); characteristic->service = service; - list_append(service->characteristics, characteristic); + if (!list_append(service->characteristics, characteristic)) { + APPL_TRACE_WARNING("%s(), no resource.", __func__); + if (characteristic->descriptors) { + list_free(characteristic->descriptors); + } + osi_free(characteristic); + return BTA_GATT_NO_RESOURCES; + } return BTA_GATT_OK; } @@ -556,7 +570,8 @@ void bta_gattc_update_include_service(const list_t *services) { for (list_node_t *sn = list_begin(services); sn != list_end(services); sn = list_next(sn)) { tBTA_GATTC_SERVICE *service = list_node(sn); if(!service || !service->included_svc || list_is_empty(service->included_svc)) break; - for (list_node_t *sn = list_begin(service->included_svc); sn != list_end(service->included_svc); sn = list_next(sn)) { + for (list_node_t *sn = list_begin(service->included_svc); sn != list_end(service->included_svc);) { + list_node_t *sn_next = list_next(sn); tBTA_GATTC_INCLUDED_SVC *include_service = list_node(sn); if(include_service && !include_service->included_service) { //update @@ -564,9 +579,10 @@ void bta_gattc_update_include_service(const list_t *services) { if(!include_service->included_service) { //not match, free it list_remove(service->included_svc, include_service); - osi_free(include_service); + // osi_free(include_service); } } + sn = sn_next; } } @@ -594,7 +610,7 @@ static void bta_gattc_explore_srvc(UINT16 conn_id, tBTA_GATTC_SERV *p_srvc_cb) APPL_TRACE_ERROR("unknown connection ID"); return; } - /* start expore a service if there is service not been explored */ + /* start explore a service if there is service not been explored */ if (p_srvc_cb->cur_srvc_idx < p_srvc_cb->total_srvc) { /* add the first service into cache */ if (bta_gattc_add_srvc_to_cache (p_srvc_cb, @@ -817,7 +833,7 @@ static tBTA_GATT_STATUS bta_gattc_add_char_to_list(tBTA_GATTC_SERV *p_srvc_cb, p_rec->e_handle = (p_srvc_cb->p_srvc_list + p_srvc_cb->cur_srvc_idx)->e_handle; memcpy(&p_rec->uuid, &uuid, sizeof(tBT_UUID)); - /* update the endind handle of pervious characteristic if available */ + /* update the endind handle of previous characteristic if available */ if (p_srvc_cb->total_char > 1) { p_rec -= 1; p_rec->e_handle = decl_handle - 1; @@ -1319,7 +1335,7 @@ void bta_gattc_fill_gatt_db_el(btgatt_db_element_t *p_attr, bta_to_btif_uuid(&p_attr->uuid, &uuid); } -void bta_gattc_get_db_with_opration(UINT16 conn_id, +void bta_gattc_get_db_with_operation(UINT16 conn_id, bt_gatt_get_db_op_t op, UINT16 char_handle, tBT_UUID *incl_uuid, @@ -1502,10 +1518,9 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services, } size_t db_size = 0; - UINT16 svc_length = list_length(services) - 1; for (list_node_t *sn = list_begin(services); - sn != list_end(services); sn = list_next(sn), svc_length--) { + sn != list_end(services); sn = list_next(sn)) { tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn); if (p_cur_srvc->e_handle < start_handle) { @@ -1519,12 +1534,8 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services, if (type == BTGATT_DB_PRIMARY_SERVICE || type == BTGATT_DB_SECONDARY_SERVICE) { if ((type == BTGATT_DB_PRIMARY_SERVICE && p_cur_srvc->is_primary) || (type == BTGATT_DB_SECONDARY_SERVICE && !p_cur_srvc->is_primary)) { - // if the current service is the last service in the db, need to ensure the current service start handle is not less than the start_handle. - if (!svc_length) { - if (p_cur_srvc->s_handle >= start_handle) { - db_size++; - } - } else { + /* Count only when declaration handle s_handle is within [start_handle, end_handle] (GATT spec). */ + if (p_cur_srvc->s_handle >= start_handle) { db_size++; } } @@ -1620,9 +1631,8 @@ static size_t bta_gattc_get_db_size(list_t *services, } size_t db_size = 0; - UINT16 svc_length = list_length(services) - 1; for (list_node_t *sn = list_begin(services); - sn != list_end(services); sn = list_next(sn), svc_length--) { + sn != list_end(services); sn = list_next(sn)) { tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn); if (p_cur_srvc->e_handle < start_handle) { @@ -1633,41 +1643,38 @@ static size_t bta_gattc_get_db_size(list_t *services, break; } - if (!svc_length) { - if (p_cur_srvc->s_handle >= start_handle) { - db_size++; - } - } else { - db_size++; - } - - if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) { + /* Count service only when declaration handle s_handle is within [start_handle, end_handle] (GATT spec). + * Skip counting this service and all its contents when s_handle < start_handle (consistent with bta_gattc_get_gatt_db_impl). */ + if (p_cur_srvc->s_handle < start_handle) { continue; } + db_size++; - for (list_node_t *cn = list_begin(p_cur_srvc->characteristics); - cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) { - tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn); + if (p_cur_srvc->characteristics && !list_is_empty(p_cur_srvc->characteristics)) { + for (list_node_t *cn = list_begin(p_cur_srvc->characteristics); + cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) { + tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn); - if (p_char->handle < start_handle) { - continue; - } - if (p_char->handle > end_handle) { - return db_size; - } - db_size++; + if (p_char->handle < start_handle) { + continue; + } + if (p_char->handle > end_handle) { + return db_size; + } + db_size++; - if (p_char->descriptors) { - for (list_node_t *dn = list_begin(p_char->descriptors); - dn != list_end(p_char->descriptors); dn = list_next(dn)) { - tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn); - if (p_desc->handle < start_handle) { - continue; + if (p_char->descriptors) { + for (list_node_t *dn = list_begin(p_char->descriptors); + dn != list_end(p_char->descriptors); dn = list_next(dn)) { + tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn); + if (p_desc->handle < start_handle) { + continue; + } + if (p_desc->handle > end_handle) { + return db_size; + } + db_size++; } - if (p_desc->handle > end_handle) { - return db_size; - } - db_size++; } } } @@ -1702,7 +1709,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en } tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb; - if (!p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) { + if ((p_srcb == NULL) || !p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) { *count = 0; return; } @@ -1792,6 +1799,11 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb, break; } + /* Output service only when declaration handle s_handle is within [start_handle, end_handle] (consistent with count logic). */ + if (p_cur_srvc->s_handle < start_handle) { + continue; + } + bta_gattc_fill_gatt_db_el(curr_db_attr, p_cur_srvc->is_primary ? BTGATT_DB_PRIMARY_SERVICE : @@ -1879,8 +1891,8 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb, bta_gattc_fill_gatt_db_el(curr_db_attr, BTGATT_DB_INCLUDED_SERVICE, p_isvc->handle, - 0 /* s_handle */, - 0 /* e_handle */, + p_isvc->incl_srvc_s_handle, + p_isvc->incl_srvc_e_handle, p_isvc->handle, p_isvc->uuid, 0 /* property */); @@ -1912,17 +1924,26 @@ void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handl if (p_clcb == NULL) { APPL_TRACE_ERROR("Unknown conn ID: %d", conn_id); + *count = 0; + *db = NULL; return; } if (p_clcb->state != BTA_GATTC_CONN_ST) { APPL_TRACE_ERROR("server cache not available, CLCB state = %d", p_clcb->state); + *count = 0; + *db = NULL; return; } - if (!p_clcb->p_srcb || p_clcb->p_srcb->p_srvc_list || /* no active discovery */ + /* Reject if no server context, discovery still in progress (p_srvc_list in use), or cache not ready + p_srvc_list must set to NULL after osi_free; + */ + if (!p_clcb->p_srcb || p_clcb->p_srcb->p_srvc_list || !p_clcb->p_srcb->p_srvc_cache) { + *count = 0; + *db = NULL; APPL_TRACE_ERROR("No server cache available"); return; } @@ -2032,10 +2053,11 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id) return; } - int i = 0; + /* i: current write index, equals actual count after loops; db_size: allocated slots from cache count */ + size_t i = 0; size_t db_size = bta_gattc_get_db_size(p_srvc_cb->p_srvc_cache, 0x0000, 0xFFFF); tBTA_GATTC_NV_ATTR *nv_attr = osi_malloc(db_size * sizeof(tBTA_GATTC_NV_ATTR)); - // This step is very importent, if not clear the memory, the hasy key base on the attribute case will be not corret. + // This step is very important, if not clear the memory, the hasy key base on the attribute case will be not correct. if (nv_attr != NULL) { memset(nv_attr, 0, db_size * sizeof(tBTA_GATTC_NV_ATTR)); } @@ -2048,6 +2070,11 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id) sn != list_end(p_srvc_cb->p_srvc_cache); sn = list_next(sn)) { tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn); + /* Bounds check: avoid buffer overflow if cache is modified and count exceeds db_size */ + if (i >= db_size) { + APPL_TRACE_ERROR("%s(), db_size exceeded (services), skip saving.", __func__); + goto save_error; + } bta_gattc_fill_nv_attr(&nv_attr[i++], BTA_GATTC_ATTR_TYPE_SRVC, p_cur_srvc->s_handle, @@ -2063,41 +2090,49 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id) sn != list_end(p_srvc_cb->p_srvc_cache); sn = list_next(sn)) { tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn); - if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) { - continue; - } - - for (list_node_t *cn = list_begin(p_cur_srvc->characteristics); - cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) { - tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn); - - bta_gattc_fill_nv_attr(&nv_attr[i++], - BTA_GATTC_ATTR_TYPE_CHAR, - p_char->handle, - 0, - p_char->uuid, - p_char->properties, - 0 /* incl_srvc_s_handle */, - 0 /* incl_srvc_e_handle */, - FALSE); - - if (!p_char->descriptors || list_is_empty(p_char->descriptors)) { - continue; - } - - for (list_node_t *dn = list_begin(p_char->descriptors); - dn != list_end(p_char->descriptors); dn = list_next(dn)) { - tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn); + if (p_cur_srvc->characteristics && !list_is_empty(p_cur_srvc->characteristics)) { + for (list_node_t *cn = list_begin(p_cur_srvc->characteristics); + cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) { + tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn); + /* Bounds check: avoid buffer overflow if count exceeds db_size */ + if (i >= db_size) { + APPL_TRACE_ERROR("%s(), db_size exceeded (characteristics), skip saving.", __func__); + goto save_error; + } bta_gattc_fill_nv_attr(&nv_attr[i++], - BTA_GATTC_ATTR_TYPE_CHAR_DESCR, - p_desc->handle, + BTA_GATTC_ATTR_TYPE_CHAR, + p_char->handle, 0, - p_desc->uuid, - 0 /* properties */, + p_char->uuid, + p_char->properties, 0 /* incl_srvc_s_handle */, 0 /* incl_srvc_e_handle */, FALSE); + + if (!p_char->descriptors || list_is_empty(p_char->descriptors)) { + continue; + } + + for (list_node_t *dn = list_begin(p_char->descriptors); + dn != list_end(p_char->descriptors); dn = list_next(dn)) { + tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn); + + /* Bounds check: avoid buffer overflow if count exceeds db_size */ + if (i >= db_size) { + APPL_TRACE_ERROR("%s(), db_size exceeded (descriptors), skip saving.", __func__); + goto save_error; + } + bta_gattc_fill_nv_attr(&nv_attr[i++], + BTA_GATTC_ATTR_TYPE_CHAR_DESCR, + p_desc->handle, + 0, + p_desc->uuid, + 0 /* properties */, + 0 /* incl_srvc_s_handle */, + 0 /* incl_srvc_e_handle */, + FALSE); + } } } @@ -2108,21 +2143,32 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id) for (list_node_t *an = list_begin(p_cur_srvc->included_svc); an != list_end(p_cur_srvc->included_svc); an = list_next(an)) { tBTA_GATTC_INCLUDED_SVC *p_isvc = list_node(an); + UINT16 incl_s_handle = p_isvc->included_service ? p_isvc->included_service->s_handle : p_isvc->incl_srvc_s_handle; + UINT16 incl_e_handle = p_isvc->included_service ? p_isvc->included_service->e_handle : p_isvc->incl_srvc_e_handle; + /* Bounds check: avoid buffer overflow if count exceeds db_size */ + if (i >= db_size) { + APPL_TRACE_ERROR("%s(), db_size exceeded (included_svc), skip saving.", __func__); + goto save_error; + } bta_gattc_fill_nv_attr(&nv_attr[i++], BTA_GATTC_ATTR_TYPE_INCL_SRVC, p_isvc->handle, 0, p_isvc->uuid, 0 /* properties */, - p_isvc->included_service->s_handle, - p_isvc->included_service->e_handle, + incl_s_handle, + incl_e_handle, FALSE); } } - /* TODO: Gattc cache write/read need to be added in IDF 3.1*/ - bta_gattc_cache_write(p_srvc_cb->server_bda, db_size, nv_attr); + bta_gattc_cache_write(p_srvc_cb->server_bda, (UINT16)db_size, nv_attr); + osi_free(nv_attr); + return; + +save_error: + APPL_TRACE_ERROR("%s(), cache inconsistency detected, not saving partial cache.", __func__); osi_free(nv_attr); } @@ -2149,11 +2195,14 @@ bool bta_gattc_cache_load(tBTA_GATTC_CLCB *p_clcb) return false; } - size_t num_attr = bta_gattc_get_cache_attr_length(index) / sizeof(tBTA_GATTC_NV_ATTR); + size_t length = bta_gattc_get_cache_attr_length(index); - if (!num_attr) { + if (length == 0 || (length % sizeof(tBTA_GATTC_NV_ATTR)) != 0) { + APPL_TRACE_ERROR("%s, Invalid cache length %d", __func__, length); return false; } + + size_t num_attr = length / sizeof(tBTA_GATTC_NV_ATTR); //don't forget to set the total attribute number. p_clcb->p_srcb->total_attr = num_attr; APPL_TRACE_DEBUG("%s(), index = %x, num_attr = %d", __func__, index, num_attr); @@ -2163,6 +2212,7 @@ bool bta_gattc_cache_load(tBTA_GATTC_CLCB *p_clcb) } if ((status = bta_gattc_co_cache_load(attr, index)) != BTA_GATT_OK) { APPL_TRACE_DEBUG("%s(), gattc cache load fail, status = %x", __func__, status); + osi_free(attr); return false; } p_clcb->searched_service_source = BTA_GATTC_SERVICE_INFO_FROM_NVS_FLASH; diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c index d6ca7bca475..80a10a8f2ad 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c @@ -172,6 +172,14 @@ static void cacheReset(BD_ADDR bda, BOOLEAN update) return; } + // Free the assoc_addr list_t structure before array shift to prevent memory leak + // Note: bta_gattc_co_cache_clear_assoc_addr only calls list_clear which clears nodes + // but doesn't free the list_t structure itself + if (cache_env->cache_addr[index].assoc_addr != NULL) { + list_free(cache_env->cache_addr[index].assoc_addr); + cache_env->cache_addr[index].assoc_addr = NULL; + } + UINT8 num = cache_env->num_addr; //delete the server_bda in the addr_info list. for(UINT8 i = index; i < (num - 1); i++) { @@ -435,6 +443,8 @@ void bta_gattc_co_cache_addr_init(void) } else { APPL_TRACE_ERROR("%s, Line = %d, nvs flash open fail, err_code = %x", __func__, __LINE__, err_code); osi_free(p_buf); + osi_free(cache_env); + cache_env = NULL; return; } @@ -444,11 +454,18 @@ void bta_gattc_co_cache_addr_init(void) void bta_gattc_co_cache_addr_deinit(void) { - APPL_TRACE_DEBUG("%s is_open=%d", __func__, cache_env->is_open); - - if(!cache_env->is_open) { + if(cache_env == NULL) { return; } + + APPL_TRACE_DEBUG("%s is_open=%d", __func__, cache_env->is_open); + + if (!cache_env->is_open) { + osi_free(cache_env); + cache_env = NULL; + return; + } + nvs_close(cache_env->addr_fp); cache_env->is_open = false; @@ -608,9 +625,30 @@ BOOLEAN bta_gattc_co_cache_append_assoc_addr(BD_ADDR src_addr, BD_ADDR assoc_add if ((addr_index = bta_gattc_co_find_addr_in_cache(src_addr)) != INVALID_ADDR_NUM) { addr_info = &cache_env->cache_addr[addr_index]; if (addr_info->assoc_addr == NULL) { - addr_info->assoc_addr =list_new(NULL); + addr_info->assoc_addr =list_new(osi_free_func); } - return list_append(addr_info->assoc_addr, p_assoc_buf); + if (addr_info->assoc_addr == NULL) { + APPL_TRACE_ERROR("assoc_addr list creation failed"); + osi_free(p_assoc_buf); + return FALSE; + } + + for (list_node_t *sn = list_begin(addr_info->assoc_addr); + sn != list_end(addr_info->assoc_addr); sn = list_next(sn)) { + if (!memcmp(list_node(sn), assoc_addr, sizeof(BD_ADDR))) { + APPL_TRACE_WARNING("Association already exists"); + osi_free(p_assoc_buf); + return TRUE; + } + } + + if (!list_append(addr_info->assoc_addr, p_assoc_buf)) { + APPL_TRACE_ERROR("Failed to append to assoc_addr list"); + osi_free(p_assoc_buf); + return FALSE; + + } + return TRUE; } else { osi_free(p_assoc_buf); } @@ -643,16 +681,15 @@ BOOLEAN bta_gattc_co_cache_remove_assoc_addr(BD_ADDR src_addr, BD_ADDR assoc_add UINT8* bta_gattc_co_cache_find_src_addr(BD_ADDR assoc_addr, UINT8 *index) { - UINT8 num = cache_env->num_addr; + UINT8 num = (cache_env->num_addr > MAX_DEVICE_IN_CACHE) ? MAX_DEVICE_IN_CACHE : cache_env->num_addr; cache_addr_info_t *addr_info = &cache_env->cache_addr[0]; UINT8 *addr_data; - //Check the assoc_addr list is NULL or not - if (addr_info->assoc_addr == NULL) { - *index = INVALID_ADDR_NUM; - return NULL; - } for (int i = 0; i < num; i++) { + if (addr_info->assoc_addr == NULL) { + addr_info++; + continue; + } for (const list_node_t *node = list_begin(addr_info->assoc_addr); node != list_end(addr_info->assoc_addr); node = list_next(node)) { addr_data = (UINT8 *)list_node(node); @@ -662,11 +699,6 @@ UINT8* bta_gattc_co_cache_find_src_addr(BD_ADDR assoc_addr, UINT8 *index) } } addr_info++; - - if (addr_info->assoc_addr == NULL) { - *index = INVALID_ADDR_NUM; - return NULL; - } } *index = INVALID_ADDR_NUM; diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_main.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_main.c index c1d1e72033c..bbf2b346bff 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_main.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_main.c @@ -41,7 +41,6 @@ enum { BTA_GATTC_OPEN, BTA_GATTC_OPEN_FAIL, - BTA_GATTC_OPEN_ERROR, BTA_GATTC_CANCEL_OPEN, BTA_GATTC_CANCEL_OPEN_OK, BTA_GATTC_CANCEL_OPEN_ERROR, @@ -77,7 +76,6 @@ typedef void (*tBTA_GATTC_ACTION)(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_da const tBTA_GATTC_ACTION bta_gattc_action[] = { bta_gattc_open, bta_gattc_open_fail, - bta_gattc_open_error, bta_gattc_cancel_open, bta_gattc_cancel_open_ok, bta_gattc_cancel_open_error, @@ -110,7 +108,6 @@ const tBTA_GATTC_ACTION bta_gattc_action[] = { #define BTA_GATTC_ACTIONS 1 /* number of actions */ #define BTA_GATTC_NEXT_STATE 1 /* position of next state */ #define BTA_GATTC_NUM_COLS 2 /* number of columns in state tables */ - /* state table for idle state */ static const UINT8 bta_gattc_st_idle[][BTA_GATTC_NUM_COLS] = { /* Event Action 1 Next state */ @@ -289,12 +286,22 @@ BOOLEAN bta_gattc_sm_execute(tBTA_GATTC_CLCB *p_clcb, UINT16 event, tBTA_GATTC_D gattc_evt_code(in_event)); #endif + // should not happen, but just in case + if (!p_clcb) { + APPL_TRACE_ERROR("p_clcb or p_data is NULL, event is %d", event); + return rt; + } /* look up the state table for the current state */ state_table = bta_gattc_st_tbl[p_clcb->state]; event &= 0x00FF; + if (event >= sizeof(bta_gattc_st_idle) / sizeof(bta_gattc_st_idle[0])) { + APPL_TRACE_ERROR("bta_gattc_sm_execute: invalid event index %d", event); + return TRUE; + } + /* set next state */ p_clcb->state = state_table[event][BTA_GATTC_NEXT_STATE]; diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_utils.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_utils.c index 6f3f3c0a4c3..1786835e330 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_utils.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_utils.c @@ -35,37 +35,16 @@ #include "bta_gattc_int.h" #include "stack/l2c_api.h" #include "osi/allocator.h" +#include "gatt_int.h" /***************************************************************************** ** Constants *****************************************************************************/ - -static const UINT8 base_uuid[LEN_UUID_128] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, - 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 - }; - static const BD_ADDR dummy_bda = {0, 0, 0, 0, 0, 0}; #define GATTC_COMMAND_QUEUE_SIZE_MAX 30 -/******************************************************************************* -** -** Function bta_gatt_convert_uuid16_to_uuid128 -** -** Description Convert a 16 bits UUID to be an standard 128 bits one. -** -** Returns TRUE if two uuid match; FALSE otherwise. -** -*******************************************************************************/ -void bta_gatt_convert_uuid16_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT16 uuid_16) -{ - UINT8 *p = &uuid_128[LEN_UUID_128 - 4]; - - memcpy (uuid_128, base_uuid, LEN_UUID_128); - - UINT16_TO_STREAM(p, uuid_16); -} /******************************************************************************* ** ** Function bta_gattc_uuid_compare @@ -77,11 +56,8 @@ void bta_gatt_convert_uuid16_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT16 uui *******************************************************************************/ BOOLEAN bta_gattc_uuid_compare (const tBT_UUID *p_src, const tBT_UUID *p_tar, BOOLEAN is_precise) { - UINT8 su[LEN_UUID_128], tu[LEN_UUID_128]; - const UINT8 *ps, *pt; - /* any of the UUID is unspecified */ - if (p_src == 0 || p_tar == 0) { + if (p_src == 0 || p_tar == 0 || p_src->len == 0 || p_tar->len == 0) { if (is_precise) { return FALSE; } else { @@ -89,29 +65,7 @@ BOOLEAN bta_gattc_uuid_compare (const tBT_UUID *p_src, const tBT_UUID *p_tar, BO } } - /* If both are 16-bit, we can do a simple compare */ - if (p_src->len == 2 && p_tar->len == 2) { - return p_src->uu.uuid16 == p_tar->uu.uuid16; - } - - /* One or both of the UUIDs is 128-bit */ - if (p_src->len == LEN_UUID_16) { - /* convert a 16 bits UUID to 128 bits value */ - bta_gatt_convert_uuid16_to_uuid128(su, p_src->uu.uuid16); - ps = su; - } else { - ps = p_src->uu.uuid128; - } - - if (p_tar->len == LEN_UUID_16) { - /* convert a 16 bits UUID to 128 bits value */ - bta_gatt_convert_uuid16_to_uuid128(tu, p_tar->uu.uuid16); - pt = tu; - } else { - pt = p_tar->uu.uuid128; - } - - return (memcmp(ps, pt, LEN_UUID_128) == 0); + return gatt_uuid_compare(*p_src, *p_tar); } /******************************************************************************* @@ -171,8 +125,13 @@ tBTA_GATTC_CLCB *bta_gattc_find_clcb_by_cif (UINT8 client_if, BD_ADDR remote_bda tBTA_GATTC_CLCB *p_clcb = &bta_gattc_cb.clcb[0]; UINT8 i; + if (remote_bda == NULL) { + return NULL; + } + for (i = 0; i < BTA_GATTC_CLCB_MAX; i ++, p_clcb ++) { if (p_clcb->in_use && + p_clcb->p_rcb != NULL && p_clcb->p_rcb->client_if == client_if && p_clcb->transport == transport && bdcmp(p_clcb->bda, remote_bda) == 0) { @@ -242,6 +201,10 @@ tBTA_GATTC_CLCB *bta_gattc_clcb_alloc(tBTA_GATTC_IF client_if, BD_ADDR remote_bd p_clcb->p_srcb->num_clcb ++; p_clcb->p_rcb->num_clcb ++; } else { + if (p_clcb->p_cmd_list) { + list_free(p_clcb->p_cmd_list); + p_clcb->p_cmd_list = NULL; + } /* release this clcb if clcb or srcb allocation failed */ p_clcb->in_use = FALSE; p_clcb = NULL; @@ -286,16 +249,16 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb) if (p_clcb) { p_srcb = p_clcb->p_srcb; - if (p_srcb->num_clcb) { + if (p_srcb != NULL && p_srcb->num_clcb) { p_srcb->num_clcb --; } - if (p_clcb->p_rcb->num_clcb) { + if (p_clcb->p_rcb != NULL && p_clcb->p_rcb->num_clcb) { p_clcb->p_rcb->num_clcb --; } /* if the srcb is no longer needed, reset the state */ - if ( p_srcb->num_clcb == 0) { + if (p_srcb != NULL && p_srcb->num_clcb == 0) { p_srcb->connected = FALSE; p_srcb->state = BTA_GATTC_SERV_IDLE; p_srcb->mtu = 0; @@ -305,15 +268,18 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb) list_free(p_srcb->p_srvc_cache); p_srcb->p_srvc_cache = NULL; } +#if (GATTC_CACHE_NVS == TRUE) + bta_gattc_co_cache_close(p_srcb->server_bda, 0); +#endif } - if ( p_clcb->p_q_cmd != NULL && !list_contains(p_clcb->p_cmd_list, p_clcb->p_q_cmd)){ + if (p_clcb->p_q_cmd != NULL && + (p_clcb->p_cmd_list == NULL || !list_contains(p_clcb->p_cmd_list, p_clcb->p_q_cmd))) { osi_free(p_clcb->p_q_cmd); p_clcb->p_q_cmd = NULL; } // don't forget to clear the command queue before dealloc the clcb. - list_clear(p_clcb->p_cmd_list); - osi_free((void *)p_clcb->p_cmd_list); + list_free(p_clcb->p_cmd_list); p_clcb->p_cmd_list = NULL; //osi_free_and_reset((void **)&p_clcb->p_q_cmd); memset(p_clcb, 0, sizeof(tBTA_GATTC_CLCB)); @@ -740,12 +706,12 @@ BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if, BD_ADDR_PTR remote_bda if (add) /* mask on the cif bit */ { - *p_cif_mask |= (1 << (client_if - 1)); + *p_cif_mask |= BTA_GATTC_CIF_MASK_BIT(client_if); } else { - if (client_if != 0) { - *p_cif_mask &= (~(1 << (client_if - 1))); - } else { + if (client_if == 0) { *p_cif_mask = 0; + } else { + *p_cif_mask &= (~BTA_GATTC_CIF_MASK_BIT(client_if)); } } /* no BG connection for this device, make it available */ @@ -777,7 +743,7 @@ BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if, BD_ADDR_PTR remote_bda p_cif_mask = is_listen ? &p_bg_tck->cif_adv_mask : &p_bg_tck->cif_mask; - *p_cif_mask = (1 << (client_if - 1)); + *p_cif_mask = BTA_GATTC_CIF_MASK_BIT(client_if); return TRUE; } } @@ -804,12 +770,12 @@ BOOLEAN bta_gattc_check_bg_conn (tBTA_GATTC_IF client_if, BD_ADDR remote_bda, U if (p_bg_tck->in_use && (bdcmp(p_bg_tck->remote_bda, remote_bda) == 0 || bdcmp(p_bg_tck->remote_bda, dummy_bda) == 0)) { - if (((p_bg_tck->cif_mask & (1 << (client_if - 1))) != 0) && + if (((p_bg_tck->cif_mask & BTA_GATTC_CIF_MASK_BIT(client_if)) != 0) && role == HCI_ROLE_MASTER) { is_bg_conn = TRUE; } - if (((p_bg_tck->cif_adv_mask & (1 << (client_if - 1))) != 0) && + if (((p_bg_tck->cif_adv_mask & BTA_GATTC_CIF_MASK_BIT(client_if)) != 0) && role == HCI_ROLE_SLAVE) { is_bg_conn = TRUE; } @@ -1009,6 +975,10 @@ tBTA_GATTC_CLCB *bta_gattc_find_int_conn_clcb(tBTA_GATTC_DATA *p_msg) { tBTA_GATTC_CLCB *p_clcb = NULL; + if (p_msg == NULL) { + return NULL; + } + if (p_msg->int_conn.role == HCI_ROLE_SLAVE) { bta_gattc_conn_find_alloc(p_msg->int_conn.remote_bda); } @@ -1044,6 +1014,10 @@ tBTA_GATTC_CLCB *bta_gattc_find_int_disconn_clcb(tBTA_GATTC_DATA *p_msg) { tBTA_GATTC_CLCB *p_clcb = NULL; + if (p_msg == NULL) { + return NULL; + } + bta_gattc_conn_dealloc(p_msg->int_conn.remote_bda); if ((p_clcb = bta_gattc_find_clcb_by_conn_id(p_msg->int_conn.hdr.layer_specific)) == NULL) { /* connection attempt failed, send connection callback event */ @@ -1072,6 +1046,8 @@ void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src) switch (p_src->len) { case 0: + /* Invalid/empty UUID: zero p_dest so callers don't use garbage */ + memset(p_dest->uu, 0, sizeof(p_dest->uu)); break; case LEN_UUID_16: @@ -1080,8 +1056,8 @@ void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src) break; case LEN_UUID_32: - p_dest->uu[12] = p_src->uu.uuid16 & 0xff; - p_dest->uu[13] = (p_src->uu.uuid16 >> 8) & 0xff; + p_dest->uu[12] = p_src->uu.uuid32 & 0xff; + p_dest->uu[13] = (p_src->uu.uuid32 >> 8) & 0xff; p_dest->uu[14] = (p_src->uu.uuid32 >> 16) & 0xff; p_dest->uu[15] = (p_src->uu.uuid32 >> 24) & 0xff; break; @@ -1093,6 +1069,7 @@ void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src) default: APPL_TRACE_ERROR("%s: Unknown UUID length %d!", __FUNCTION__, p_src->len); + memset(p_dest->uu, 0, sizeof(p_dest->uu)); break; } } diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c index 4e786bc8a1e..9688b5d2bc9 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c @@ -36,6 +36,7 @@ #include #include "osi/allocator.h" #include "l2c_int.h" +#include "gatt_int.h" static void bta_gatts_nv_save_cback(BOOLEAN is_saved, tGATTS_HNDL_RANGE *p_hndl_range); static BOOLEAN bta_gatts_nv_srv_chg_cback(tGATTS_SRV_CHG_CMD cmd, tGATTS_SRV_CHG_REQ *p_req, @@ -176,13 +177,15 @@ void bta_gatts_register(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) tBTA_GATT_STATUS status = BTA_GATT_OK; UINT8 i, first_unuse = 0xff; + memset(&cb_data, 0, sizeof(tBTA_GATTS)); + if (p_cb->enabled == FALSE) { bta_gatts_enable(p_cb); } for (i = 0; i < BTA_GATTS_MAX_APP_NUM; i ++) { if (p_cb->rcb[i].in_use) { - if (bta_gatts_uuid_compare(p_cb->rcb[i].app_uuid, p_msg->api_reg.app_uuid)) { + if (gatt_uuid_compare(p_cb->rcb[i].app_uuid, p_msg->api_reg.app_uuid)) { APPL_TRACE_ERROR("application already registered.\n"); status = BTA_GATT_DUP_REG; break; @@ -199,9 +202,7 @@ void bta_gatts_register(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) } cb_data.reg_oper.server_if = BTA_GATTS_INVALID_IF; -// btla-specific ++ memcpy(&cb_data.reg_oper.uuid, &p_msg->api_reg.app_uuid, sizeof(tBT_UUID)); -// btla-specific -- if (first_unuse != 0xff) { APPL_TRACE_VERBOSE("register application first_unuse rcb_idx = %d", first_unuse); @@ -213,6 +214,7 @@ void bta_gatts_register(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) GATT_Register(&p_msg->api_reg.app_uuid, &bta_gatts_cback); if ( !p_cb->rcb[first_unuse].gatt_if) { status = BTA_GATT_NO_RESOURCES; + memset( &p_cb->rcb[first_unuse], 0 , sizeof(tBTA_GATTS_RCB)); } else { if ((p_buf = (tBTA_GATTS_INT_START_IF *) osi_malloc(sizeof(tBTA_GATTS_INT_START_IF))) != NULL) { @@ -222,6 +224,7 @@ void bta_gatts_register(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) bta_sys_sendmsg(p_buf); } else { status = BTA_GATT_NO_RESOURCES; + GATT_Deregister(p_cb->rcb[first_unuse].gatt_if); memset( &p_cb->rcb[first_unuse], 0 , sizeof(tBTA_GATTS_RCB)); } } @@ -309,7 +312,7 @@ void bta_gatts_deregister(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) void bta_gatts_create_srvc(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg) { UINT8 rcb_idx; - tBTA_GATTS cb_data; + tBTA_GATTS cb_data = {0}; UINT8 srvc_idx; UINT16 service_id = 0; @@ -869,7 +872,7 @@ void bta_gatts_send_service_change_indication (tBTA_GATTS_DATA *p_msg) tBTA_GATTS_RCB *p_rcb = bta_gatts_find_app_rcb_by_app_if(p_msg->api_send_service_change.server_if); tBTA_GATTS_SERVICE_CHANGE service_change; tBTA_GATT_STATUS status = BTA_GATT_OK; - UINT16 addr[BD_ADDR_LEN] = {0}; + UINT8 addr[BD_ADDR_LEN] = {0}; if(memcmp(p_msg->api_send_service_change.remote_bda, addr, BD_ADDR_LEN) != 0) { BD_ADDR bd_addr; memcpy(bd_addr, p_msg->api_send_service_change.remote_bda, BD_ADDR_LEN); diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c index b712da9b796..358b6939913 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c @@ -223,6 +223,7 @@ void BTA_GATTS_AddCharacteristic (UINT16 service_id, const tBT_UUID * p_char_u UINT16 len = 0; if(attr_val != NULL){ len = attr_val->attr_len; + APPL_TRACE_DEBUG("attr_val->attr_len = %x, attr_max_len = %x\n",attr_val->attr_len, attr_val->attr_max_len); } if ((p_buf = (tBTA_GATTS_API_ADD_CHAR *) osi_malloc(sizeof(tBTA_GATTS_API_ADD_CHAR))) != NULL) { memset(p_buf, 0, sizeof(tBTA_GATTS_API_ADD_CHAR)); @@ -234,14 +235,19 @@ void BTA_GATTS_AddCharacteristic (UINT16 service_id, const tBT_UUID * p_char_u if(control !=NULL){ p_buf->control.auto_rsp = control->auto_rsp; } + if(attr_val != NULL){ - APPL_TRACE_DEBUG("!!!!!!attr_val->attr_len = %x\n",attr_val->attr_len); - APPL_TRACE_DEBUG("!!!!!!!attr_val->attr_max_len = %x\n",attr_val->attr_max_len); p_buf->attr_val.attr_len = attr_val->attr_len; p_buf->attr_val.attr_max_len = attr_val->attr_max_len; - p_buf->attr_val.attr_val = (uint8_t *)osi_malloc(len); - if(p_buf->attr_val.attr_val != NULL){ - memcpy(p_buf->attr_val.attr_val, attr_val->attr_val, len); + if(len != 0){ + p_buf->attr_val.attr_val = (uint8_t *)osi_malloc(len); + if(p_buf->attr_val.attr_val != NULL){ + memcpy(p_buf->attr_val.attr_val, attr_val->attr_val, len); + } else { + p_buf->attr_val.attr_len = 0; + p_buf->attr_val.attr_max_len = 0; + APPL_TRACE_ERROR("Allocate fail for %s\n", __func__); + } } } @@ -302,6 +308,8 @@ void BTA_GATTS_AddCharDescriptor (UINT16 service_id, memcpy(p_buf->attr_val.attr_val, attr_val->attr_val, value_len); } else{ + p_buf->attr_val.attr_len = 0; + p_buf->attr_val.attr_max_len = 0; APPL_TRACE_ERROR("Allocate fail for %s\n", __func__); } @@ -497,6 +505,9 @@ void BTA_SetAttributeValue(UINT16 attr_handle, UINT16 length, UINT8 *value) if(value != NULL){ if((p_buf->value = (UINT8 *)osi_malloc(length)) != NULL){ memcpy(p_buf->value, value, length); + } else { + p_buf->length = 0; + APPL_TRACE_ERROR("Allocate fail for %s\n", __func__); } } diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_main.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_main.c index bf1174c5f77..6444321437a 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_main.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_main.c @@ -109,6 +109,14 @@ BOOLEAN bta_gatts_hdl_event(BT_HDR *p_msg) case BTA_GATTS_API_SET_ATTR_VAL_EVT:{ UINT16 attr_id = ((tBTA_GATTS_DATA *) p_msg)->api_set_val.hdr.layer_specific; p_srvc_cb = bta_gatts_find_srvc_cb_by_attr_id(p_cb, attr_id); + if (p_srvc_cb == NULL) { + if (((tBTA_GATTS_DATA *) p_msg)->api_set_val.value != NULL) { + osi_free(((tBTA_GATTS_DATA *) p_msg)->api_set_val.value); + } + APPL_TRACE_ERROR("Service not found for attribute ID: %d", attr_id); + break; + } + bta_gatts_set_attr_value(p_srvc_cb, (tBTA_GATTS_DATA *) p_msg); break; } diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_utils.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_utils.c index 224e887334e..d697f0dc190 100644 --- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_utils.c +++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_utils.c @@ -31,27 +31,7 @@ #include "bta/bta_sys.h" #include "bta_gatts_int.h" -static const UINT8 base_uuid[LEN_UUID_128] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, - 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 - }; -/******************************************************************************* -** -** Function bta_gatt_convert_uuid16_to_uuid128 -** -** Description Convert a 16 bits UUID to be an standard 128 bits one. -** -** Returns TRUE if two uuid match; FALSE otherwise. -** -*******************************************************************************/ -static void bta_gatt_convert_uuid16_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT16 uuid_16) -{ - UINT8 *p = &uuid_128[LEN_UUID_128 - 4]; - - memcpy (uuid_128, base_uuid, LEN_UUID_128); - - UINT16_TO_STREAM(p, uuid_16); -} /******************************************************************************* ** ** Function bta_gatts_alloc_srvc_cb @@ -167,6 +147,7 @@ tBTA_GATTS_SRVC_CB *bta_gatts_find_srvc_cb_by_attr_id(tBTA_GATTS_CB *p_cb, UINT1 attr_id >= p_cb->srvc_cb[i].service_id) || /* last service incb */ (i == (BTA_GATTS_MAX_SRVC_NUM - 1) && + p_cb->srvc_cb[i].in_use && attr_id >= p_cb->srvc_cb[i].service_id) ) { return &p_cb->srvc_cb[i]; @@ -174,51 +155,5 @@ tBTA_GATTS_SRVC_CB *bta_gatts_find_srvc_cb_by_attr_id(tBTA_GATTS_CB *p_cb, UINT1 } return NULL; } -/******************************************************************************* -** -** Function bta_gatts_uuid_compare -** -** Description Compare two UUID to see if they are the same. -** -** Returns TRUE if two uuid match; FALSE otherwise. -** -*******************************************************************************/ -BOOLEAN bta_gatts_uuid_compare(tBT_UUID tar, tBT_UUID src) -{ - UINT8 su[LEN_UUID_128], tu[LEN_UUID_128]; - UINT8 *ps, *pt; - - /* any of the UUID is unspecified */ - if (src.len == 0 || tar.len == 0) { - return TRUE; - } - - /* If both are 16-bit, we can do a simple compare */ - if (src.len == 2 && tar.len == 2) { - return src.uu.uuid16 == tar.uu.uuid16; - } - - /* One or both of the UUIDs is 128-bit */ - if (src.len == LEN_UUID_16) { - /* convert a 16 bits UUID to 128 bits value */ - bta_gatt_convert_uuid16_to_uuid128(su, src.uu.uuid16); - ps = su; - } else { - ps = src.uu.uuid128; - } - - if (tar.len == LEN_UUID_16) { - /* convert a 16 bits UUID to 128 bits value */ - bta_gatt_convert_uuid16_to_uuid128(tu, tar.uu.uuid16); - pt = tu; - } else { - pt = tar.uu.uuid128; - } - - return (memcmp(ps, pt, LEN_UUID_128) == 0); -} - - - #endif /* GATTS_INCLUDED */ diff --git a/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h b/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h index ac42de6973a..e74b5759ee7 100644 --- a/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h +++ b/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h @@ -383,6 +383,10 @@ typedef UINT16 tBTA_GATTC_CIF_MASK; typedef UINT32 tBTA_GATTC_CIF_MASK; #endif +/* Safe bit for client_if in cif_mask; avoids UB when client_if is 0 or > GATT_MAX_APPS */ +#define BTA_GATTC_CIF_MASK_BIT(cif) \ + ((tBTA_GATTC_CIF_MASK)(((cif) >= 1 && (cif) <= (unsigned)GATT_MAX_APPS) ? (1U << ((cif) - 1)) : 0U)) + typedef struct { BOOLEAN in_use; BD_ADDR remote_bda; @@ -456,7 +460,6 @@ extern void bta_gattc_process_enc_cmpl(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m /* function within state machine */ extern void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data); extern void bta_gattc_open_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data); -extern void bta_gattc_open_error(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data); extern void bta_gattc_cancel_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data); extern void bta_gattc_cancel_open_ok(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data); @@ -542,7 +545,7 @@ extern void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid, btgatt_db_element_t **svc_db, UINT16 *count); -extern void bta_gattc_get_db_with_opration(UINT16 conn_id, +extern void bta_gattc_get_db_with_operation(UINT16 conn_id, bt_gatt_get_db_op_t op, UINT16 char_handle, tBT_UUID *incl_uuid, diff --git a/components/bt/host/bluedroid/bta/gatt/include/bta_gatts_int.h b/components/bt/host/bluedroid/bta/gatt/include/bta_gatts_int.h index 854a28a2087..8a5e4a77494 100644 --- a/components/bt/host/bluedroid/bta/gatt/include/bta_gatts_int.h +++ b/components/bt/host/bluedroid/bta/gatt/include/bta_gatts_int.h @@ -243,7 +243,6 @@ extern void bta_gatts_close (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg); extern void bta_gatts_send_service_change_indication (tBTA_GATTS_DATA *p_msg); extern void bta_gatts_show_local_database (void); -extern BOOLEAN bta_gatts_uuid_compare(tBT_UUID tar, tBT_UUID src); extern tBTA_GATTS_RCB *bta_gatts_find_app_rcb_by_app_if(tBTA_GATTS_IF server_if); extern UINT8 bta_gatts_find_app_rcb_idx_by_app_if(tBTA_GATTS_CB *p_cb, tBTA_GATTS_IF server_if); extern UINT8 bta_gatts_alloc_srvc_cb(tBTA_GATTS_CB *p_cb, UINT8 rcb_idx); diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_api.h b/components/bt/host/bluedroid/bta/include/bta/bta_api.h index 6b783c3a5c5..370ccb79a4a 100644 --- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h +++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h @@ -410,42 +410,18 @@ typedef struct { UINT8 tx_power; } tBTA_BLE_ADV_DATA; -typedef void (tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTA_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info); - -typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status); +// typedef void (tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTA_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info); typedef tBTM_VSC_CMPL_CB tBTA_SEND_VENDOR_HCI_CMPL_CBACK; -typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK; - -typedef tBTM_START_STOP_ADV_CMPL_CBACK tBTA_START_STOP_ADV_CMPL_CBACK; - -typedef tBTM_UPDATE_WHITELIST_CBACK tBTA_UPDATE_WHITELIST_CBACK; - -typedef tBTM_SET_PKT_DATA_LENGTH_CBACK tBTA_SET_PKT_DATA_LENGTH_CBACK; +// typedef tBTM_UPDATE_WHITELIST_CBACK tBTA_UPDATE_WHITELIST_CBACK; typedef tBTM_DTM_CMD_CMPL_CBACK tBTA_DTM_CMD_CMPL_CBACK; -typedef tBTM_SET_RAND_ADDR_CBACK tBTA_SET_RAND_ADDR_CBACK; - -typedef tBTM_SET_LOCAL_PRIVACY_CBACK tBTA_SET_LOCAL_PRIVACY_CBACK; - -typedef tBTM_SET_RPA_TIMEOUT_CMPL_CBACK tBTA_SET_RPA_TIMEOUT_CMPL_CBACK; - -typedef tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK tBTA_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK; - -typedef tBTM_SET_PRIVACY_MODE_CMPL_CBACK tBTA_SET_PRIVACY_MODE_CMPL_CBACK; - -typedef tBTM_SET_CSA_SUPPORT_CMPL_CBACK tBTA_SET_CSA_SUPPORT_CMPL_CBACK; - -typedef tBTM_SET_VENDOR_EVT_MASK_CBACK tBTA_SET_VENDOR_EVT_MASK_CBACK; - typedef tBTM_CMPL_CB tBTA_CMPL_CB; typedef tBTM_VSC_CMPL tBTA_VSC_CMPL; -typedef tBTM_TX_POWER_RESULTS tBTA_TX_POWER_RESULTS; - typedef tBTM_RSSI_RESULTS tBTA_RSSI_RESULTS; typedef tBTM_BLE_CH_MAP_RESULTS tBTA_BLE_CH_MAP_RESULTS; @@ -746,7 +722,6 @@ typedef UINT8 tBTA_DM_BLE_CONN_TYPE; typedef BOOLEAN (tBTA_DM_BLE_SEL_CBACK)(BD_ADDR random_bda, UINT8 *p_remote_name); typedef tBTM_LE_UPDATE_CONN_PRAMS tBTA_LE_UPDATE_CONN_PRAMS; -typedef tBTM_UPDATE_CONN_PARAM_CBACK tBTA_UPDATE_CONN_PARAM_CBACK; /* Structure associated with BTA_DM_BLE_SEC_REQ_EVT */ @@ -1206,11 +1181,7 @@ typedef void (tBTA_BLE_SCAN_REP_CBACK) (tBTA_DM_BLE_REF_VALUE ref_value, UINT8 r UINT8 num_records, UINT16 data_len, UINT8 *p_rep_data, tBTA_STATUS status); -typedef void (tBTA_START_STOP_SCAN_CMPL_CBACK) (tBTA_STATUS status); -typedef void (tBTA_START_STOP_ADV_CMPL_CBACK) (tBTA_STATUS status); - -typedef void (tBTA_CLEAR_ADV_CMPL_CBACK) (tBTA_STATUS status); #else typedef UINT8 tBTA_DM_BLE_SEC_ACT; @@ -1669,10 +1640,10 @@ extern tBTM_BLE_5_HCI_CBACK ble_5_hci_cb; #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #define BTA_BLE_ISO_BIG_CREATE_COMPLETE_EVT BTM_BLE_ISO_BIG_CREATE_COMPLETE_EVT #define BTA_BLE_ISO_BIG_TERMINATE_COMPLETE_EVT BTM_BLE_ISO_BIG_TERMINATE_COMPLETE_EVT -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) #define BTA_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT BTM_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT #define BTA_BLE_ISO_BIG_SYNC_LOST_EVT BTM_BLE_ISO_BIG_SYNC_LOST_EVT @@ -2017,11 +1988,11 @@ void BTA_DmSetMinEncKeySize(UINT8 key_size, tBTM_CMPL_CB *p_cb); ** Returns void ** *******************************************************************************/ -void BTA_DmBleSetChannels(const uint8_t *channels, tBTA_CMPL_CB *set_channels_cb); +void BTA_DmBleSetChannels(const uint8_t *channels); -extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove, BD_ADDR remote_addr, tBLE_ADDR_TYPE addr_type, tBTA_UPDATE_WHITELIST_CBACK *update_wl_cb); +extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove, BD_ADDR remote_addr, tBLE_ADDR_TYPE addr_type); -extern void BTA_DmClearWhiteList(tBTA_UPDATE_WHITELIST_CBACK *update_wl_cb); +extern void BTA_DmClearWhiteList(void); extern void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb); #endif ///BLE_INCLUDED == TRUE @@ -2036,7 +2007,7 @@ extern void BTA_DmWriteNewConnTxPwrLvl(INT8 pwr_lvl_min, INT8 pwr_lvl_max, tBTA_ extern void BTA_DmReadBredrTxPwrLvl(tBTM_TX_PWR_LVL_TYPE type, tBTA_CMPL_CB *cmpl_cb); extern void BTA_DmWriteBredrTxPwrLvl(tBTM_TX_PWR_LVL_TYPE type, INT8 tx_power, tBTA_CMPL_CB *cmpl_cb); #endif // #if (CLASSIC_BT_INCLUDED == TRUE) -extern void BTA_DmBleReadChannelMap(BD_ADDR remote_device, tBTA_CMPL_CB *p_callback); +extern void BTA_DmBleReadChannelMap(BD_ADDR remote_device); /******************************************************************************* ** @@ -2593,26 +2564,6 @@ extern void BTA_DmSetBlePrefConnParams(BD_ADDR bd_addr, extern void BTA_DmSetBleConnScanParams(UINT32 scan_interval, UINT32 scan_window); -/******************************************************************************* -** -** Function BTA_DmSetBleScanParams -** -** Description This function is called to set scan parameters -** -** Parameters: client_if - Client IF -** scan_interval - scan interval -** scan_window - scan window -** scan_mode - scan mode -** scan_param_setup_status_cback - Set scan param status callback -** -** Returns void -** -*******************************************************************************/ -extern void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval, - UINT32 scan_window, tBLE_SCAN_MODE scan_mode, - tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_status_cback); - - /******************************************************************************* ** ** Function BTA_DmSetBleScanFilterParams @@ -2631,13 +2582,13 @@ extern void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval, *******************************************************************************/ extern void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window, tBLE_SCAN_MODE scan_mode, UINT8 scan_fil_poilcy, - UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback); + UINT8 addr_type_own, UINT8 scan_duplicate_filter); -extern void BTA_DmSetBleAdvParamsAll (UINT16 adv_int_min, UINT16 adv_int_max, +extern void BTA_DmAdvStartWithParams (UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, tBLE_ADDR_TYPE addr_type_own, tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP adv_fil_pol, - tBLE_BD_ADDR *p_dir_bda, tBTA_START_ADV_CMPL_CBACK p_start_adv_cb); + tBLE_BD_ADDR *p_dir_bda); /******************************************************************************* @@ -2727,25 +2678,6 @@ extern void BTA_DmSetEncryption(BD_ADDR bd_addr, tBTA_TRANSPORT transport, tBTA_DM_ENCRYPT_CBACK *p_callback, tBTA_DM_BLE_SEC_ACT sec_act); - -/******************************************************************************* -** -** Function BTA_DmBleObserve -** -** Description This procedure keep the device listening for advertising -** events from a broadcast device. -** -** Parameters start: start or stop observe. -** duration : Duration of the scan. Continuous scan if 0 is passed -** p_results_cb: Callback to be called with scan results -** -** Returns void -** -*******************************************************************************/ -extern void BTA_DmBleObserve(BOOLEAN start, UINT32 duration, - tBTA_DM_SEARCH_CBACK *p_results_cb, - tBTA_START_STOP_SCAN_CMPL_CBACK *p_start_stop_scan_cb); - /******************************************************************************* ** ** Function BTA_DmBleScan @@ -2761,17 +2693,15 @@ extern void BTA_DmBleObserve(BOOLEAN start, UINT32 duration, ** *******************************************************************************/ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration, - tBTA_DM_SEARCH_CBACK *p_results_cb, - tBTA_START_STOP_SCAN_CMPL_CBACK *p_start_stop_scan_cb); + tBTA_DM_SEARCH_CBACK *p_results_cb); -extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback); +extern void BTA_DmSetRandAddress(BD_ADDR rand_addr); extern void BTA_DmClearRandAddress(void); -extern void BTA_DmBleSetRpaTimeout(uint16_t rpa_timeout,tBTA_SET_RPA_TIMEOUT_CMPL_CBACK *p_set_rpa_timeout_cback); +extern void BTA_DmBleSetRpaTimeout(uint16_t rpa_timeout); extern void BTA_DmBleAddDevToResolvingList(BD_ADDR addr, uint8_t addr_type, - PEER_IRK irk, - tBTA_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *add_dev_to_resolving_list_callback); + PEER_IRK irk); #endif #if BLE_INCLUDED == TRUE @@ -2783,11 +2713,11 @@ extern void BTA_DmBleAddDevToResolvingList(BD_ADDR addr, ** Description Enable/disable privacy on the local device ** ** Parameters: privacy_enable - enable/disable privacy on remote device. -** set_local_privacy_cback -callback to be called with result +** ** Returns void ** *******************************************************************************/ -extern void BTA_DmBleConfigLocalPrivacy(BOOLEAN privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback); +extern void BTA_DmBleConfigLocalPrivacy(BOOLEAN privacy_enable); /******************************************************************************* ** @@ -2845,8 +2775,7 @@ extern void BTA_DmBleEnableRemotePrivacy(BD_ADDR bd_addr, BOOLEAN privacy_enable ** *******************************************************************************/ extern void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, - tBTA_BLE_ADV_DATA *p_adv_cfg, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback); + tBTA_BLE_ADV_DATA *p_adv_cfg); /******************************************************************************* ** @@ -2861,8 +2790,7 @@ extern void BTA_DmBleSetAdvConfig (tBTA_BLE_AD_MASK data_mask, ** Returns None ** *******************************************************************************/ -extern void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback); +extern void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len); /******************************************************************************* @@ -2876,7 +2804,7 @@ extern void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len, ** Returns None ** *******************************************************************************/ -void BTA_DmBleClearAdv (tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback); +void BTA_DmBleClearAdv (void); /******************************************************************************* ** @@ -2890,8 +2818,7 @@ void BTA_DmBleClearAdv (tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback); ** *******************************************************************************/ extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, - tBTA_BLE_ADV_DATA *p_adv_cfg, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback); + tBTA_BLE_ADV_DATA *p_adv_cfg); /******************************************************************************* ** @@ -2901,13 +2828,12 @@ extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask, ** ** Parameters p_raw_scan_rsp : raw scan_rspertising data. ** raw_scan_rsp_len : raw scan_rspertising data length. -** p_scan_rsp_data_cback : set scan_rsp data complete callback. +** ** ** Returns None ** *******************************************************************************/ -extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len, - tBTA_SET_ADV_DATA_CMPL_CBACK *p_scan_rsp_data_cback); +extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len); /******************************************************************************* ** @@ -2924,8 +2850,7 @@ extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_l ** *******************************************************************************/ extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, - BD_ADDR device_info, - tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback); + BD_ADDR device_info); /******************************************************************************* ** @@ -2934,12 +2859,12 @@ extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, ** Description This function starts or stops LE broadcasting. ** ** Parameters start: start or stop broadcast. -** p_start_stop_adv_cb: stop broadcast completed event +** ** ** Returns None ** *******************************************************************************/ -extern void BTA_DmBleAdvStop (BOOLEAN start, tBTA_START_STOP_ADV_CMPL_CBACK *p_start_stop_adv_cb); +extern void BTA_DmBleAdvStop (void); /******************************************************************************* ** @@ -2979,7 +2904,7 @@ extern void BTA_DmBleDisconnect(BD_ADDR bd_addr); ** Returns void ** *******************************************************************************/ -extern void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length, tBTA_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback); +extern void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length); #if (BLE_42_DTM_TEST_EN == TRUE) extern void BTA_DmBleDtmTxStart(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback); extern void BTA_DmBleDtmRxStart(uint8_t rx_channel, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback); @@ -2987,11 +2912,11 @@ extern void BTA_DmBleDtmRxStart(uint8_t rx_channel, tBTA_DTM_CMD_CMPL_CBACK *p_d extern void BTA_DmBleDtmStop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback); -extern void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t privacy_mode, tBTA_SET_PRIVACY_MODE_CMPL_CBACK *p_cback); +extern void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t privacy_mode); -extern void BTA_DmBleGapSetCsaSupport(uint8_t csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK *p_callback); +extern void BTA_DmBleGapSetCsaSupport(uint8_t csa_select); -extern void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask, tBTA_SET_VENDOR_EVT_MASK_CBACK *p_callback); +extern void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask); #if (BLE_FEAT_POWER_CONTROL_EN == TRUE) void BTA_DmBleGapEnhReadTransPwrLevel(uint16_t conn_handle, uint8_t phy); @@ -3135,11 +3060,11 @@ extern void BTA_DmBleGapEnableMonitorAdv(UINT8 enable); #endif // #if (BLE_FEAT_ADV_MONITOR == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) extern void BTA_DmBleGapIsoBigCreate(tBTA_DM_BLE_BIG_CREATE_PARAMS *p_big_creat_param); extern void BTA_DmBleGapIsoBigCreateTest(tBTA_DM_BLE_BIG_CREATE_TEST_PARAMS *p_big_creat_test_param); extern void BTA_DmBleGapIsoBigTerminate(tBTA_DM_BLE_BIG_TERMINATE_PARAMS *p_big_terminate_param); -#endif// #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif// #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) extern void BTA_DmBleGapIsoBigSyncCreate(tBTA_DM_BLE_BIG_SYNC_CREATE_PARAMS *p_big_sync_param); extern void BTA_DmBleGapIsoBigSyncTerminate(tBTA_DM_BLE_BIG_SYNC_TERMINATE_PARAMS *p_big_sync_terminate_param); diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_gatt_common.h b/components/bt/host/bluedroid/bta/include/bta/bta_gatt_common.h index 2d696729fee..0a42cc31160 100644 --- a/components/bt/host/bluedroid/bta/include/bta/bta_gatt_common.h +++ b/components/bt/host/bluedroid/bta/include/bta/bta_gatt_common.h @@ -10,6 +10,7 @@ * * ******************************************************************************/ +#pragma once #include "stack/bt_types.h" diff --git a/components/bt/host/bluedroid/bta/sys/bta_sys_main.c b/components/bt/host/bluedroid/bta/sys/bta_sys_main.c index ea1bc5a8540..3bf41d9dabc 100644 --- a/components/bt/host/bluedroid/bta/sys/bta_sys_main.c +++ b/components/bt/host/bluedroid/bta/sys/bta_sys_main.c @@ -103,6 +103,7 @@ enum { #define BTA_SYS_ACTIONS 2 /* number of actions */ #define BTA_SYS_NEXT_STATE 2 /* position of next state */ #define BTA_SYS_NUM_COLS 3 /* number of columns in state tables */ +#define BTA_SYS_NUM_STATES 4 /* OFF, STARTING, ON, STOPPING */ /* state table for OFF state */ @@ -213,22 +214,39 @@ BOOLEAN bta_sys_sm_execute(BT_HDR *p_msg) BOOLEAN freebuf = TRUE; tBTA_SYS_ST_TBL state_table; UINT8 action; + UINT8 evt_idx; int i; + if (p_msg == NULL) { + return freebuf; + } + + evt_idx = p_msg->event & 0x00ff; + if (evt_idx >= BTA_SYS_NUM_ACTIONS) { + APPL_TRACE_ERROR("bta_sys_sm_execute: event 0x%x out of range (evt_idx=%u)", p_msg->event, evt_idx); + return freebuf; + } + if (bta_sys_cb.state >= BTA_SYS_NUM_STATES) { + APPL_TRACE_ERROR("bta_sys_sm_execute: invalid state %u", bta_sys_cb.state); + return freebuf; + } + APPL_TRACE_EVENT("bta_sys_sm_execute state:%d, event:0x%x\n", bta_sys_cb.state, p_msg->event); /* look up the state table for the current state */ state_table = bta_sys_st_tbl[bta_sys_cb.state]; /* update state */ - bta_sys_cb.state = state_table[p_msg->event & 0x00ff][BTA_SYS_NEXT_STATE]; + bta_sys_cb.state = state_table[evt_idx][BTA_SYS_NEXT_STATE]; /* execute action functions */ for (i = 0; i < BTA_SYS_ACTIONS; i++) { - if ((action = state_table[p_msg->event & 0x00ff][i]) != BTA_SYS_IGNORE) { - (*bta_sys_action[action])( (tBTA_SYS_HW_MSG *) p_msg); - } else { + action = state_table[evt_idx][i]; + if (action == BTA_SYS_IGNORE) { break; } + if (action < BTA_SYS_NUM_ACTIONS) { + (*bta_sys_action[action])( (tBTA_SYS_HW_MSG *) p_msg); + } } return freebuf; @@ -598,16 +616,29 @@ void bta_alarm_cb(void *data) void bta_sys_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, INT32 timeout_ms) { + osi_alarm_t *alarm = NULL; + assert(p_tle != NULL); // Get the alarm for this p_tle. osi_mutex_lock(&bta_alarm_lock, OSI_MUTEX_MAX_TIMEOUT); if (!hash_map_has_key(bta_alarm_hash_map, p_tle)) { - hash_map_set(bta_alarm_hash_map, p_tle, osi_alarm_new("bta_sys", bta_alarm_cb, p_tle, 0)); + alarm = osi_alarm_new("bta_sys", bta_alarm_cb, p_tle, 0); + if (alarm == NULL) { + APPL_TRACE_ERROR("%s unable to create new alarm.", __func__); + osi_mutex_unlock(&bta_alarm_lock); + return; + } + if (!hash_map_set(bta_alarm_hash_map, p_tle, alarm)) { + APPL_TRACE_ERROR("%s unable to set alarm in map.", __func__); + osi_alarm_free(alarm); + osi_mutex_unlock(&bta_alarm_lock); + return; + } } osi_mutex_unlock(&bta_alarm_lock); - osi_alarm_t *alarm = hash_map_get(bta_alarm_hash_map, p_tle); + alarm = hash_map_get(bta_alarm_hash_map, p_tle); if (alarm == NULL) { APPL_TRACE_ERROR("%s unable to create alarm.", __func__); return; diff --git a/components/bt/host/bluedroid/btc/core/btc_ble_storage.c b/components/bt/host/bluedroid/btc/core/btc_ble_storage.c index aef3863111f..ac810a94bc3 100644 --- a/components/bt/host/bluedroid/btc/core/btc_ble_storage.c +++ b/components/bt/host/bluedroid/btc/core/btc_ble_storage.c @@ -177,6 +177,7 @@ static bt_status_t _btc_storage_get_ble_bonding_key(bt_bdaddr_t *remote_bd_addr, break; case BTM_LE_KEY_LID: name = BTC_BLE_STORAGE_LE_KEY_LID_STR; + break; default: return BT_STATUS_FAIL; } @@ -1045,9 +1046,10 @@ bt_status_t btc_storage_set_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr, uint8 { int ret; bdstr_t bdstr; - + btc_config_lock(); bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr_t)); ret = btc_config_set_bin(bdstr, BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR, value, (size_t)len); + btc_config_unlock(); if (ret == false) { return BT_STATUS_FAIL; } diff --git a/components/bt/host/bluedroid/btc/core/btc_config.c b/components/bt/host/bluedroid/btc/core/btc_config.c index e2cce6da73f..c7edd3f6691 100644 --- a/components/bt/host/bluedroid/btc/core/btc_config.c +++ b/components/bt/host/bluedroid/btc/core/btc_config.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -85,7 +85,11 @@ static void btc_key_value_to_string(uint8_t *key_value, char *value_str, int key bool btc_config_init(void) { - osi_mutex_new(&lock); + if (osi_mutex_new(&lock) != 0) { + BTC_TRACE_ERROR("%s unable to create lock.\n", __func__); + return false; + } + config = config_new(CONFIG_FILE_PATH); if (!config) { BTC_TRACE_WARNING("%s unable to load config file; starting unconfigured.\n", __func__); @@ -101,7 +105,7 @@ bool btc_config_init(void) return true; -error:; +error: config_free(config); osi_mutex_free(&lock); config = NULL; diff --git a/components/bt/host/bluedroid/btc/core/btc_dm.c b/components/bt/host/bluedroid/btc/core/btc_dm.c index 02b5a16ef4c..5f91481b6fb 100644 --- a/components/bt/host/bluedroid/btc/core/btc_dm.c +++ b/components/bt/host/bluedroid/btc/core/btc_dm.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -29,7 +29,8 @@ /****************************************************************************** ** Constants & Macros ******************************************************************************/ -#define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id)) +/* Use 1ULL to avoid UB: 1 << 32 is undefined when int is 32-bit (C11 §6.5.7) */ +#define BTA_SERVICE_ID_TO_SERVICE_MASK(id) ((tBTA_SERVICE_MASK)(1ULL << (id))) /****************************************************************************** ** Static variables @@ -697,7 +698,7 @@ bt_status_t btc_dm_enable_service(tBTA_SERVICE_ID service_id) { tBTA_SERVICE_ID *p_id = &service_id; - btc_dm_cb.btc_enabled_services |= (1 << service_id); + btc_dm_cb.btc_enabled_services |= (tBTA_SERVICE_MASK)(1ULL << service_id); BTC_TRACE_DEBUG("%s: current services:0x%x", __FUNCTION__, btc_dm_cb.btc_enabled_services); @@ -710,7 +711,7 @@ bt_status_t btc_dm_disable_service(tBTA_SERVICE_ID service_id) { tBTA_SERVICE_ID *p_id = &service_id; - btc_dm_cb.btc_enabled_services &= (tBTA_SERVICE_MASK)(~(1 << service_id)); + btc_dm_cb.btc_enabled_services &= (tBTA_SERVICE_MASK)(~(1ULL << service_id)); BTC_TRACE_DEBUG("%s: Current Services:0x%x", __FUNCTION__, btc_dm_cb.btc_enabled_services); @@ -808,8 +809,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg) case BTA_DM_DISABLE_EVT: { tBTA_SERVICE_MASK service_mask = btc_get_enabled_services_mask(); for (int i = 0; i <= BTA_MAX_SERVICE_ID; i++) { - if (service_mask & - (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) { + if (service_mask & BTA_SERVICE_ID_TO_SERVICE_MASK(i)) { btc_in_execute_service_request(i, FALSE); } } diff --git a/components/bt/host/bluedroid/btc/core/btc_main.c b/components/bt/host/bluedroid/btc/core/btc_main.c index 0802202797b..4de7c8aabd7 100644 --- a/components/bt/host/bluedroid/btc/core/btc_main.c +++ b/components/bt/host/bluedroid/btc/core/btc_main.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -53,7 +53,12 @@ static void btc_init_bluetooth(void) { osi_alarm_create_mux(); osi_alarm_init(); - bte_main_boot_entry(btc_init_callback); + if (bte_main_boot_entry(btc_init_callback) != 0) { + osi_alarm_deinit(); + osi_alarm_delete_mux(); + future_ready(*btc_main_get_future_p(BTC_MAIN_INIT_FUTURE), FUTURE_FAIL); + return; + } #if (SMP_INCLUDED) btc_config_init(); diff --git a/components/bt/host/bluedroid/btc/core/btc_storage.c b/components/bt/host/bluedroid/btc/core/btc_storage.c index bee44e18d38..9b197e3b060 100644 --- a/components/bt/host/bluedroid/btc/core/btc_storage.c +++ b/components/bt/host/bluedroid/btc/core/btc_storage.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -42,23 +42,33 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr, /* device not in bond list and exceed the maximum number of bonded devices, delete the inactive bonded device */ if (btc_storage_get_num_all_bond_devices() >= BTM_SEC_MAX_BONDS && !btc_config_has_section(bdstr)) { const btc_config_section_iter_t *iter = btc_config_section_begin(); - const btc_config_section_iter_t *remove_iter = iter; - /* find the first device(the last node) */ + const btc_config_section_iter_t *remove_iter = NULL; + /* find the last bdaddr-formatted device section */ while (iter != btc_config_section_end()) { - remove_iter = iter; + const char *name = btc_config_section_name(iter); + if (name && string_is_bdaddr(name)) { + remove_iter = iter; + } iter = btc_config_section_next(iter); } - const char *remove_section = btc_config_section_name(remove_iter); - // delete device info - string_to_bdaddr(remove_section, &bd_addr); - BTA_DmRemoveDevice(bd_addr.address, BT_TRANSPORT_BR_EDR); - BTA_DmRemoveDevice(bd_addr.address, BT_TRANSPORT_LE); + if (remove_iter != NULL) { + const char *remove_section = btc_config_section_name(remove_iter); + if (string_to_bdaddr(remove_section, &bd_addr)) { + // delete device info + BTA_DmRemoveDevice(bd_addr.address, BT_TRANSPORT_BR_EDR); + BTA_DmRemoveDevice(bd_addr.address, BT_TRANSPORT_LE); - // delete config info - if (btc_config_remove_section(remove_section)) { - BTC_TRACE_WARNING("exceeded the maximum number of bonded devices, delete the first device info : %02x:%02x:%02x:%02x:%02x:%02x", - bd_addr.address[0], bd_addr.address[1], bd_addr.address[2], bd_addr.address[3], bd_addr.address[4], bd_addr.address[5]); + // delete config info + if (btc_config_remove_section(remove_section)) { + BTC_TRACE_WARNING("exceeded the maximum number of bonded devices, delete the first device info : %02x:%02x:%02x:%02x:%02x:%02x", + bd_addr.address[0], bd_addr.address[1], bd_addr.address[2], bd_addr.address[3], bd_addr.address[4], bd_addr.address[5]); + } + } else { + BTC_TRACE_ERROR("Failed to convert section name to bdaddr: %s", remove_section); + } + } else { + BTC_TRACE_WARNING("No bdaddr-formatted section found to remove"); } } diff --git a/components/bt/host/bluedroid/btc/profile/std/cte/btc_ble_cte.c b/components/bt/host/bluedroid/btc/profile/std/cte/btc_ble_cte.c index a4f4377cb61..1ea2920c63b 100644 --- a/components/bt/host/bluedroid/btc/profile/std/cte/btc_ble_cte.c +++ b/components/bt/host/bluedroid/btc/profile/std/cte/btc_ble_cte.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -26,7 +26,7 @@ static inline void btc_cte_ble_cb_to_app(esp_ble_cte_cb_event_t event, esp_ble_c static void btc_ble_cte_callback(tBTM_BLE_CTE_EVENT event, tBTM_BLE_CTE_CB_PARAMS *params) { - esp_ble_cte_cb_param_t param; + esp_ble_cte_cb_param_t param = {0}; bt_status_t ret; btc_msg_t msg; msg.sig = BTC_SIG_API_CB; @@ -159,7 +159,11 @@ void btc_ble_cte_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->cte_trans_params.antenna_ids, src->cte_trans_params.antenna_ids, src->cte_trans_params.switching_pattern_len); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->cte_trans_params.switching_pattern_len = 0; + dst->cte_trans_params.antenna_ids = NULL; } + } else { + dst->cte_trans_params.antenna_ids = NULL; } break; case BTC_CTE_ACT_SET_IQ_SAMPLING_EN: @@ -168,8 +172,12 @@ void btc_ble_cte_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) if (dst->cte_iq_sampling_en.antenna_ids) { memcpy(dst->cte_iq_sampling_en.antenna_ids, src->cte_iq_sampling_en.antenna_ids, src->cte_iq_sampling_en.switching_pattern_len); } else { + dst->cte_iq_sampling_en.switching_pattern_len = 0; + dst->cte_iq_sampling_en.antenna_ids = NULL; BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } + } else { + dst->cte_iq_sampling_en.antenna_ids = NULL; } break; #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) @@ -181,8 +189,12 @@ void btc_ble_cte_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) if (dst->cte_recv_params.antenna_ids) { memcpy(dst->cte_recv_params.antenna_ids, src->cte_recv_params.antenna_ids, src->cte_recv_params.switching_pattern_len); } else { + dst->cte_recv_params.switching_pattern_len = 0; + dst->cte_recv_params.antenna_ids = NULL; BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } + } else { + dst->cte_recv_params.antenna_ids = NULL; } break; case BTC_CTE_ACT_SET_CONN_CTE_TRANS_PARAMS: @@ -191,8 +203,12 @@ void btc_ble_cte_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) if (dst->cte_conn_trans_params.antenna_ids) { memcpy(dst->cte_conn_trans_params.antenna_ids, src->cte_conn_trans_params.antenna_ids, src->cte_conn_trans_params.switching_pattern_len); } else { + dst->cte_conn_trans_params.switching_pattern_len = 0; + dst->cte_conn_trans_params.antenna_ids = NULL; BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } + } else { + dst->cte_conn_trans_params.antenna_ids = NULL; } break; #endif // #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) @@ -258,7 +274,11 @@ void btc_ble_cte_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->connless_iq_rpt.i_sample, &(src->connless_iq_rpt.i_sample[0]), src->connless_iq_rpt.sample_count); } else { + dst->connless_iq_rpt.sample_count = 0; + dst->connless_iq_rpt.i_sample = NULL; + dst->connless_iq_rpt.q_sample = NULL; BTC_TRACE_ERROR("%s, i_sample malloc failed\n", __func__); + break; } dst->connless_iq_rpt.q_sample = osi_malloc(src->connless_iq_rpt.sample_count); if (dst->connless_iq_rpt.q_sample) { @@ -266,7 +286,14 @@ void btc_ble_cte_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) src->connless_iq_rpt.sample_count); } else { BTC_TRACE_ERROR("%s, q_sample malloc failed\n", __func__); + osi_free(dst->connless_iq_rpt.i_sample); + dst->connless_iq_rpt.sample_count = 0; + dst->connless_iq_rpt.i_sample = NULL; + dst->connless_iq_rpt.q_sample = NULL; } + } else { + dst->connless_iq_rpt.i_sample = NULL; + dst->connless_iq_rpt.q_sample = NULL; } break; #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) @@ -278,15 +305,26 @@ void btc_ble_cte_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->conn_iq_rpt.i_sample, src->conn_iq_rpt.i_sample, src->conn_iq_rpt.sample_count); } else { + dst->conn_iq_rpt.i_sample = NULL; + dst->conn_iq_rpt.q_sample = NULL; + dst->conn_iq_rpt.sample_count = 0; BTC_TRACE_ERROR("%s, i_sample malloc failed\n", __func__); + break; } dst->conn_iq_rpt.q_sample = osi_malloc(src->conn_iq_rpt.sample_count); if (dst->conn_iq_rpt.q_sample) { memcpy(dst->conn_iq_rpt.q_sample, src->conn_iq_rpt.q_sample, src->conn_iq_rpt.sample_count); } else { + osi_free(dst->conn_iq_rpt.i_sample); + dst->conn_iq_rpt.i_sample = NULL; + dst->conn_iq_rpt.q_sample = NULL; + dst->conn_iq_rpt.sample_count = 0; BTC_TRACE_ERROR("%s, q_sample malloc failed\n", __func__); } + } else { + dst->conn_iq_rpt.i_sample = NULL; + dst->conn_iq_rpt.q_sample = NULL; } break; #endif // #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) @@ -303,8 +341,8 @@ void btc_ble_cte_cb_deep_free(btc_msg_t *msg) #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) case ESP_BLE_CTE_CONNLESS_IQ_REPORT_EVT: { esp_ble_cte_cb_param_t *params = (esp_ble_cte_cb_param_t *)msg->arg; - uint8_t *i_sample = &(params->connless_iq_rpt.i_sample[0]); - uint8_t *q_sample = &(params->connless_iq_rpt.q_sample[0]); + uint8_t *i_sample = params->connless_iq_rpt.i_sample; + uint8_t *q_sample = params->connless_iq_rpt.q_sample; if (i_sample) { osi_free(i_sample); } diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c index 8487ebfbeed..76ce330e529 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c @@ -27,6 +27,7 @@ #if (BT_CONTROLLER_INCLUDED == TRUE) #include "esp_bt.h" #endif +#include "bta_dm_gap.h" #if (BLE_INCLUDED == TRUE) #if (BLE_42_FEATURE_SUPPORT == TRUE) @@ -88,6 +89,10 @@ static void btc_gap_ble_get_dev_name_callback(UINT8 status, char *name) ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); if (ret != BT_STATUS_SUCCESS) { + if (param.get_dev_name_cmpl.name) { + osi_free(param.get_dev_name_cmpl.name); + } + BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__); } } @@ -213,6 +218,9 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT mask |= BTM_BLE_AD_BIT_MANU; bta_adv_data->p_manu->len = p_adv_data->manufacturer_len; memcpy(bta_adv_data->p_manu->p_val, p_adv_data->p_manufacturer_data, p_adv_data->manufacturer_len); + } else { + osi_free(bta_adv_data->p_manu); + bta_adv_data->p_manu = NULL; } } } @@ -246,6 +254,11 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT p_elem = p_prop->p_elem; if (NULL != p_elem) { memcpy(p_elem++, p_elem_service_data, sizeof(tBTA_BLE_PROP_ELEM)); + } else { + osi_free(p_elem_service_data->p_val); + osi_free(bta_adv_data->p_proprietary); + bta_adv_data->p_proprietary = NULL; + mask &= ~BTM_BLE_AD_BIT_PROPRIETARY; } } osi_free(p_elem_service_data); @@ -274,6 +287,10 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT mask |= BTM_BLE_AD_BIT_SERVICE; ++bta_adv_data->p_services->num_service; *p_uuid_out16++ = bt_uuid.uu.uuid16; + } else { + osi_free(bta_adv_data->p_services); + bta_adv_data->p_services = NULL; + BTC_TRACE_ERROR("%s - memory malloc failed", __FUNCTION__); } break; } @@ -338,7 +355,7 @@ static void btc_adv_data_callback(tBTA_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT; - param.adv_data_cmpl.status = status; + param.adv_data_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -357,7 +374,7 @@ static void btc_scan_rsp_data_callback(tBTA_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SCAN_RSP_DATA_SET_COMPLETE_EVT; - param.scan_rsp_data_cmpl.status = status; + param.scan_rsp_data_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -376,7 +393,7 @@ static void btc_adv_data_raw_callback(tBTA_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT; - param.adv_data_raw_cmpl.status = status; + param.adv_data_raw_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -395,7 +412,7 @@ static void btc_scan_rsp_data_raw_callback(tBTA_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT; - param.scan_rsp_data_raw_cmpl.status = status; + param.scan_rsp_data_raw_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -405,30 +422,27 @@ static void btc_scan_rsp_data_raw_callback(tBTA_STATUS status) } } -static void btc_ble_set_adv_data(esp_ble_adv_data_t *adv_data, - tBTA_SET_ADV_DATA_CMPL_CBACK p_adv_data_cback) +static void btc_ble_set_adv_data(esp_ble_adv_data_t *adv_data) { tBTA_BLE_AD_MASK data_mask = 0; if (!adv_data->set_scan_rsp) { btc_to_bta_adv_data(adv_data, &gl_bta_adv_data, &data_mask); - BTA_DmBleSetAdvConfig(data_mask, &gl_bta_adv_data, p_adv_data_cback); + BTA_DmBleSetAdvConfig(data_mask, &gl_bta_adv_data); } else { btc_to_bta_adv_data(adv_data, &gl_bta_scan_rsp_data, &data_mask); - BTA_DmBleSetScanRsp(data_mask, &gl_bta_scan_rsp_data, p_adv_data_cback); + BTA_DmBleSetScanRsp(data_mask, &gl_bta_scan_rsp_data); } } -static void btc_ble_set_adv_data_raw(uint8_t *raw_adv, uint32_t raw_adv_len, - tBTA_SET_ADV_DATA_CMPL_CBACK p_adv_data_cback) +static void btc_ble_set_adv_data_raw(uint8_t *raw_adv, uint32_t raw_adv_len) { - BTA_DmBleSetAdvConfigRaw(raw_adv, raw_adv_len, p_adv_data_cback); + BTA_DmBleSetAdvConfigRaw(raw_adv, raw_adv_len); } -static void btc_ble_set_scan_rsp_data_raw(uint8_t *raw_scan_rsp, uint32_t raw_scan_rsp_len, - tBTA_SET_ADV_DATA_CMPL_CBACK p_scan_rsp_data_cback) +static void btc_ble_set_scan_rsp_data_raw(uint8_t *raw_scan_rsp, uint32_t raw_scan_rsp_len) { - BTA_DmBleSetScanRspRaw(raw_scan_rsp, raw_scan_rsp_len, p_scan_rsp_data_cback); + BTA_DmBleSetScanRspRaw(raw_scan_rsp, raw_scan_rsp_len); } static void btc_start_adv_callback(uint8_t status) @@ -440,7 +454,7 @@ static void btc_start_adv_callback(uint8_t status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_ADV_START_COMPLETE_EVT; - param.adv_start_cmpl.status = btc_hci_to_esp_status(status); + param.adv_start_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -459,7 +473,7 @@ static void btc_stop_adv_callback(uint8_t status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT; - param.adv_stop_cmpl.status = btc_hci_to_esp_status(status); + param.adv_stop_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -471,7 +485,7 @@ static void btc_stop_adv_callback(uint8_t status) #endif // #if (BLE_42_ADV_EN == TRUE) #if (BLE_42_ADV_EN == TRUE) -static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBTA_START_ADV_CMPL_CBACK start_adv_cback) +static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params) { tBLE_BD_ADDR peer_addr; esp_bt_status_t status = ESP_BT_STATUS_SUCCESS; @@ -497,14 +511,14 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBT status = ESP_BT_STATUS_PARM_INVALID; BTC_TRACE_ERROR("Invalid advertisting channel map parameters.\n"); } + if (!BLE_ISVALID_PARAM(ble_adv_params->peer_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RANDOM)) { status = ESP_BT_STATUS_PARM_INVALID; BTC_TRACE_ERROR("Invalid advertisting peer address type parameters.\n"); } + if(status != ESP_BT_STATUS_SUCCESS) { - if(start_adv_cback) { - start_adv_cback(status); - } + btc_start_adv_callback(status); return; } @@ -512,14 +526,13 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBT memcpy(peer_addr.bda, ble_adv_params->peer_addr, ESP_BD_ADDR_LEN); peer_addr.type = ble_adv_params->peer_addr_type; - BTA_DmSetBleAdvParamsAll(ble_adv_params->adv_int_min, + BTA_DmAdvStartWithParams(ble_adv_params->adv_int_min, ble_adv_params->adv_int_max, ble_adv_params->adv_type, ble_adv_params->own_addr_type, ble_adv_params->channel_map, ble_adv_params->adv_filter_policy, - &peer_addr, - start_adv_cback); + &peer_addr); } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -533,7 +546,7 @@ static void btc_scan_params_callback(tGATT_IF gatt_if, tBTM_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT; - param.scan_param_cmpl.status = status; + param.scan_param_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -543,7 +556,7 @@ static void btc_scan_params_callback(tGATT_IF gatt_if, tBTM_STATUS status) } } -static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback) +static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params) { if (BLE_ISVALID_PARAM(scan_params->scan_interval, BTM_BLE_SCAN_INT_MIN, BTM_BLE_SCAN_INT_MAX) && BLE_ISVALID_PARAM(scan_params->scan_window, BTM_BLE_SCAN_WIN_MIN, BTM_BLE_SCAN_WIN_MAX) && @@ -557,8 +570,7 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA scan_params->scan_type, scan_params->scan_filter_policy, scan_params->own_addr_type, - scan_params->scan_duplicate, - scan_param_setup_cback); + scan_params->scan_duplicate); } else { btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE); } @@ -676,7 +688,7 @@ static void btc_start_scan_callback(uint8_t status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SCAN_START_COMPLETE_EVT; - param.scan_start_cmpl.status = status; + param.scan_start_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -695,7 +707,7 @@ static void btc_stop_scan_callback(tBTA_STATUS status) msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SCAN_STOP_COMPLETE_EVT; - param.scan_stop_cmpl.status = status; + param.scan_stop_cmpl.status = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -731,14 +743,14 @@ void btc_update_duplicate_exceptional_list_callback(tBTA_STATUS status, uint8_t } } -static void btc_ble_update_duplicate_exceptional_list(uint8_t subcode, uint32_t info_type, BD_ADDR device_info, - tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_ignore_list_cback) +static void btc_ble_update_duplicate_exceptional_list(uint8_t subcode, uint32_t info_type, BD_ADDR device_info) { - BTA_DmUpdateDuplicateExceptionalList(subcode, info_type, device_info, p_update_duplicate_ignore_list_cback); + BTA_DmUpdateDuplicateExceptionalList(subcode, info_type, device_info); } #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) -void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDATE_CONN_PRAMS *update_conn_params) +void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, UINT16 min_conn_int, UINT16 max_conn_int, + UINT16 conn_int, UINT16 slave_latency, UINT16 supervision_tout) { esp_ble_gap_cb_param_t param; bt_status_t ret; @@ -747,11 +759,11 @@ void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDA msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT; param.update_conn_params.status = btc_hci_to_esp_status(status); - param.update_conn_params.min_int = update_conn_params->min_conn_int; - param.update_conn_params.max_int = update_conn_params->max_conn_int; - param.update_conn_params.conn_int = update_conn_params->conn_int; - param.update_conn_params.latency = update_conn_params->slave_latency; - param.update_conn_params.timeout = update_conn_params->supervision_tout; + param.update_conn_params.min_int = min_conn_int; + param.update_conn_params.max_int = max_conn_int; + param.update_conn_params.conn_int = conn_int; + param.update_conn_params.latency = slave_latency; + param.update_conn_params.timeout = supervision_tout; memcpy(param.update_conn_params.bda, bd_addr, sizeof(esp_bd_addr_t)); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -761,7 +773,7 @@ void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDA } } -static void btc_set_pkt_length_callback(UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_len_params) +static void btc_set_pkt_length_callback(UINT8 status, UINT16 rx_len, UINT16 tx_len) { esp_ble_gap_cb_param_t param; bt_status_t ret; @@ -770,8 +782,8 @@ static void btc_set_pkt_length_callback(UINT8 status, tBTM_LE_SET_PKT_DATA_LENGT msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SET_PKT_LENGTH_COMPLETE_EVT; param.pkt_data_length_cmpl.status = btc_btm_status_to_esp_status(status); - param.pkt_data_length_cmpl.params.rx_len = data_len_params->rx_len; - param.pkt_data_length_cmpl.params.tx_len = data_len_params->tx_len; + param.pkt_data_length_cmpl.params.rx_len = rx_len; + param.pkt_data_length_cmpl.params.tx_len = tx_len; ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -780,9 +792,8 @@ static void btc_set_pkt_length_callback(UINT8 status, tBTM_LE_SET_PKT_DATA_LENGT } } -static void btc_gap_ble_set_channels_cmpl_callback(void *p_data) +static void btc_gap_ble_set_channels_cmpl_callback(tBTM_STATUS status) { - tBTA_BLE_SET_CHANNELS_RESULTS *result = (tBTA_BLE_SET_CHANNELS_RESULTS *)p_data; esp_ble_gap_cb_param_t param; bt_status_t ret; btc_msg_t msg = {0}; @@ -790,7 +801,7 @@ static void btc_gap_ble_set_channels_cmpl_callback(void *p_data) msg.pid = BTC_PID_GAP_BLE; msg.act = ESP_GAP_BLE_SET_CHANNELS_EVT; - param.ble_set_channels.stat = btc_btm_status_to_esp_status(result->status); + param.ble_set_channels.stat = btc_btm_status_to_esp_status(status); ret = btc_transfer_context(&msg, ¶m, sizeof(esp_ble_gap_cb_param_t), NULL, NULL); @@ -942,6 +953,106 @@ static void btc_ble_read_channel_map_callback(void *p_data) } } +#if (BLE_VENDOR_HCI_EN == TRUE) +static void btc_clear_adv_callback(uint8_t status); +static void btc_ble_set_csa_support_callback(UINT8 status); +static void btc_ble_set_vendor_evt_mask_callback(UINT8 status); +#endif // #if (BLE_VENDOR_HCI_EN == TRUE) +static void btc_ble_set_privacy_mode_callback(UINT8 status); + +void btc_ble_legacy_gap_callback(tBTM_BLE_LEGACY_GAP_EVENT event, tBTM_BLE_LEGACY_GAP_CB_PARAMS *params) +{ + switch(event) { +#if (BLE_42_ADV_EN == TRUE) + case BTM_BLE_LEGACY_GAP_ADV_DATA_SET_COMPLETE_EVT: + btc_adv_data_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_ADV_RAW_SET_COMPLETE_EVT: + btc_adv_data_raw_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_SCAN_RSP_SET_COMPLETE_EVT: + btc_scan_rsp_data_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_RSP_RAW_SET_COMPLETE_EVT: + btc_scan_rsp_data_raw_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_ADV_START_COMPLETE_EVT: + btc_start_adv_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_ADV_STOP_COMPLETE_EVT: + btc_stop_adv_callback(params->status); + break; +#endif // #if (BLE_42_ADV_EN == TRUE) +#if (BLE_42_SCAN_EN == TRUE) + case BTM_BLE_LEGACY_GAP_SCAN_PARAMS_SET_COMPLETE_EVT: + btc_scan_params_callback(ESP_DEFAULT_GATT_IF, params->status); + break; + case BTM_BLE_LEGACY_GAP_SCAN_START_COMPLETE_EVT: + btc_start_scan_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_SCAN_STOP_COMPLETE_EVT: + btc_stop_scan_callback(params->status); + break; +#endif // #if (BLE_42_SCAN_EN == TRUE) + case BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT: + btc_set_pkt_length_callback(params->data_length_params.status, + params->data_length_params.rx_len, + params->data_length_params.tx_len); + break; + case BTM_BLE_LEGACY_GAP_CONNECTION_PARAMS_UPDATE_EVT: + btc_update_conn_param_callback(params->conn_params_update.status, + params->conn_params_update.remote_bd_addr, + params->conn_params_update.min_conn_int, + params->conn_params_update.max_conn_int, + params->conn_params_update.conn_int, + params->conn_params_update.slave_latency, + params->conn_params_update.supervision_tout); + break; + case BTM_BLE_LEGACY_GAP_SET_RANDOM_ADDR_EVT: + btc_set_rand_addr_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_RPA_TIMEOUT_EVT: + btc_set_rpa_timeout_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_ADD_DEV_TO_RPA_LIST_EVT: + btc_add_dev_to_resolving_list_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_SET_PRIVACY_EVT: + btc_set_local_privacy_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT: + btc_update_whitelist_complete_callback(params->white_list_update.status, params->white_list_update.operation); + break; + case BTM_BLE_LEGACY_GAP_READ_CHANNEL_MAP_EVT: + btc_ble_read_channel_map_callback(¶ms->ch_map_results); + break; + case BTM_BLE_LEGACY_GAP_EXCEPTION_LIST_UPDATE_EVT: +#if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) + btc_update_duplicate_exceptional_list_callback(params->exception_list_up.status, params->exception_list_up.subcode, params->exception_list_up.length, params->exception_list_up.device_info); +#endif // #if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) + break; +#if (BLE_VENDOR_HCI_EN == TRUE) + case BTM_BLE_LEGACY_GAP_CLEAR_ADV_COMPLETE_EVT: + btc_clear_adv_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_SET_CSA_SUPPORT_COMPLETE_EVT: + btc_ble_set_csa_support_callback(params->status); + break; + case BTM_BLE_LEGACY_GAP_SET_VENDOR_EVT_MASK_COMPLETE_EVT: + btc_ble_set_vendor_evt_mask_callback(params->status); + break; +#endif // #if (BLE_VENDOR_HCI_EN == TRUE) + case BTM_BLE_LEGACY_GAP_SET_CHANNELS_COMPLETE_EVT: + btc_gap_ble_set_channels_cmpl_callback(params->set_channels.status); + break; + case BTM_BLE_LEGACY_GAP_SET_PRIVACY_MODE_COMPLETE_EVT: + btc_ble_set_privacy_mode_callback(params->status); + break; + default: + BTC_TRACE_ERROR("%s: Unknown event %d\n", __func__, event); + break; + } +} #if (BLE_50_FEATURE_SUPPORT == TRUE) void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event, @@ -1816,30 +1927,26 @@ void btc_get_whitelist_size(uint16_t *length) #if (BLE_42_FEATURE_SUPPORT == TRUE) #if (BLE_42_SCAN_EN == TRUE) static void btc_ble_start_scanning(uint32_t duration, - tBTA_DM_SEARCH_CBACK *results_cb, - tBTA_START_STOP_SCAN_CMPL_CBACK *start_scan_cb) + tBTA_DM_SEARCH_CBACK *results_cb) { - if ((results_cb != NULL) && (start_scan_cb != NULL)) { + if (results_cb != NULL) { //Start scan the device - BTA_DmBleScan(true, duration, results_cb, start_scan_cb); + BTA_DmBleScan(true, duration, results_cb); } else { - BTC_TRACE_ERROR("The start_scan_cb or results_cb invalid\n"); + BTC_TRACE_ERROR("The results_cb invalid\n"); } } -static void btc_ble_stop_scanning(tBTA_START_STOP_SCAN_CMPL_CBACK *stop_scan_cb) +static void btc_ble_stop_scanning(void) { - uint8_t duration = 0; - BTA_DmBleScan(false, duration, NULL, stop_scan_cb); + BTA_DmBleScan(false, 0, NULL); } #endif // #if (BLE_42_SCAN_EN == TRUE) #if (BLE_42_ADV_EN == TRUE) -static void btc_ble_stop_advertising(tBTA_START_STOP_ADV_CMPL_CBACK *stop_adv_cb) +static void btc_ble_stop_advertising(void) { - bool stop_adv = false; - - BTA_DmBleAdvStop(stop_adv, stop_adv_cb); + BTA_DmBleAdvStop(); } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -1859,7 +1966,7 @@ static void btc_ble_update_conn_params(BD_ADDR bd_addr, uint16_t min_int, latency, timeout); } -static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_length, tBTA_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback) +static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_length) { if (tx_data_length > BTM_BLE_DATA_SIZE_MAX) { tx_data_length = BTM_BLE_DATA_SIZE_MAX; @@ -1867,7 +1974,7 @@ static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_len tx_data_length = BTM_BLE_DATA_SIZE_MIN; } - BTA_DmBleSetDataLength(remote_device, tx_data_length, p_set_pkt_data_cback); + BTA_DmBleSetDataLength(remote_device, tx_data_length); } static void btc_ble_config_local_icon(uint16_t icon) @@ -1875,8 +1982,9 @@ static void btc_ble_config_local_icon(uint16_t icon) BTA_DmBleConfigLocalIcon(icon); } -static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback) +static void btc_ble_set_rand_addr (BD_ADDR rand_addr) { + bool is_addr_valid = false; if (rand_addr != NULL) { /* A static address is a 48-bit randomly generated address and shall meet the following requirements: @@ -1895,40 +2003,47 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK * if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK) { invalid_rand_addr_b[0] = invalid_rand_addr_b[0] | BT_STATIC_RAND_ADDR_MASK; if (memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0 && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0) { - BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback); + is_addr_valid = true; } else { - btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR); + is_addr_valid = false; BTC_TRACE_ERROR("Invalid static random address, the high bit should be 0b11, bits of the random part shall not be all 1 or 0"); } } else if ((rand_addr[0] | BT_NON_RPA_MASK) == BT_NON_RPA_MASK) { invalid_rand_addr_a[0] = invalid_rand_addr_a[0] & BT_NON_RPA_MASK; if (memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0 && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0) { - BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback); + is_addr_valid = true; } else { - btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR); + is_addr_valid = false; BTC_TRACE_ERROR("Invalid non-resolvable private address, the high bit should be 0b00, bits of the random part shall not be all 1 or 0"); } }else { - btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR); + is_addr_valid = false; BTC_TRACE_ERROR("Invalid random address type"); } } else { - btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR); + is_addr_valid = false; BTC_TRACE_ERROR("Invalid address, the address value is NULL"); } + + if (is_addr_valid) + { + BTA_DmSetRandAddress(rand_addr); + } else { + btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR); + } + } -static void btc_ble_set_rpa_timeout(uint16_t rpa_timeout,tBTA_SET_RPA_TIMEOUT_CMPL_CBACK *set_rpa_timeout_cback) +static void btc_ble_set_rpa_timeout(uint16_t rpa_timeout) { - BTA_DmBleSetRpaTimeout(rpa_timeout,set_rpa_timeout_cback); + BTA_DmBleSetRpaTimeout(rpa_timeout); } static void btc_ble_add_device_to_resolving_list(BD_ADDR addr, uint8_t addr_type, - uint8_t irk[], - tBTA_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *add_dev_to_resolving_list_callback) + uint8_t irk[]) { - BTA_DmBleAddDevToResolvingList(addr, addr_type, irk, add_dev_to_resolving_list_callback); + BTA_DmBleAddDevToResolvingList(addr, addr_type, irk); } static void btc_ble_clear_rand_addr (void) @@ -1936,9 +2051,9 @@ static void btc_ble_clear_rand_addr (void) BTA_DmClearRandAddress(); } -static void btc_ble_config_local_privacy(bool privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback) +static void btc_ble_config_local_privacy(bool privacy_enable) { - BTA_DmBleConfigLocalPrivacy(privacy_enable, set_local_privacy_cback); + BTA_DmBleConfigLocalPrivacy(privacy_enable); } static void btc_ble_disconnect(BD_ADDR bd_addr) @@ -1948,7 +2063,7 @@ static void btc_ble_disconnect(BD_ADDR bd_addr) static void btc_gap_ble_set_channels(esp_gap_ble_channels channels) { - BTA_DmBleSetChannels(channels, btc_gap_ble_set_channels_cmpl_callback); + BTA_DmBleSetChannels(channels); } #if (BLE_42_DTM_TEST_EN == TRUE) @@ -1993,10 +2108,9 @@ static void btc_ble_dtm_stop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback) #endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE)) static void btc_ble_set_privacy_mode(uint8_t addr_type, BD_ADDR addr, - uint8_t privacy_mode, - tBTA_SET_PRIVACY_MODE_CMPL_CBACK *p_cback) + uint8_t privacy_mode) { - BTA_DmBleSetPrivacyMode(addr_type, addr, privacy_mode, p_cback); + BTA_DmBleSetPrivacyMode(addr_type, addr, privacy_mode); } void btc_gap_ble_cb_handler(btc_msg_t *msg) @@ -2152,6 +2266,9 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); } + } else { + dst->periodic_adv_cfg_data.data = NULL; + dst->periodic_adv_cfg_data.len = 0; } break; } @@ -2240,6 +2357,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) case BTC_GAP_BLE_SET_PA_RSP_DATA: { btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src; btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest; + dst->per_adv_response_data_params.response_data = NULL; if (src->per_adv_response_data_params.response_data && src->per_adv_response_data_params.response_data_len) { dst->per_adv_response_data_params.response_data = osi_malloc(src->per_adv_response_data_params.response_data_len); if (dst->per_adv_response_data_params.response_data) { @@ -2253,6 +2371,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) case BTC_GAP_BLE_SET_PA_SYNC_SUBEVT: { btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src; btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest; + dst->per_sync_subevent_params.subevent = NULL; if (src->per_sync_subevent_params.subevent && src->per_sync_subevent_params.num_subevents_to_sync) { dst->per_sync_subevent_params.subevent = osi_malloc(src->per_sync_subevent_params.num_subevents_to_sync); if (dst->per_sync_subevent_params.subevent) { @@ -2336,9 +2455,9 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) break; #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) #if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) - case BTA_BLE_GAP_CS_SUBEVENT_RESULT_EVT: + case ESP_GAP_BLE_CS_SUBEVENT_RESULT_EVT: if (src->cs_subevt_result.step_info) { - dst->cs_subevt_result.step_info = osi_malloc(src->cs_subevt_result.num_steps_reported * sizeof(esp_ble_cs_step_info)); + dst->cs_subevt_result.step_info = osi_calloc(src->cs_subevt_result.num_steps_reported * sizeof(esp_ble_cs_step_info)); if (dst->cs_subevt_result.step_info) { for (UINT8 i = 0; i < src->cs_subevt_result.num_steps_reported; i++) { @@ -2359,9 +2478,9 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) } } break; - case BTA_BLE_GAP_CS_SUBEVENT_RESULT_CONTINUE_EVT: + case ESP_GAP_BLE_CS_SUBEVENT_RESULT_CONTINUE_EVT: if (src->cs_subevt_result_continue.step_info) { - dst->cs_subevt_result_continue.step_info = osi_malloc(src->cs_subevt_result_continue.num_steps_reported * sizeof(esp_ble_cs_step_info)); + dst->cs_subevt_result_continue.step_info = osi_calloc(src->cs_subevt_result_continue.num_steps_reported * sizeof(esp_ble_cs_step_info)); if (dst->cs_subevt_result_continue.step_info) { for (UINT8 i = 0; i < src->cs_subevt_result_continue.num_steps_reported; i++) { @@ -2371,7 +2490,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) if (src->cs_subevt_result_continue.step_info[i].step_data_len) { dst->cs_subevt_result_continue.step_info[i].data = osi_malloc(src->cs_subevt_result_continue.step_info[i].step_data_len); if (dst->cs_subevt_result_continue.step_info[i].data) { - memcpy(dst->cs_subevt_result_continue.step_info[i].data, src->cs_subevt_result_continue.step_info[i].data, src->cs_subevt_result.step_info[i].step_data_len); + memcpy(dst->cs_subevt_result_continue.step_info[i].data, src->cs_subevt_result_continue.step_info[i].data, src->cs_subevt_result_continue.step_info[i].step_data_len); } else { BTC_TRACE_ERROR("%s, data, no enough memory.", __func__); } @@ -2580,7 +2699,7 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg) break; #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) #if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) - case BTA_BLE_GAP_CS_SUBEVENT_RESULT_EVT: + case ESP_GAP_BLE_CS_SUBEVENT_RESULT_EVT: { esp_ble_cs_step_info *step_info = ((esp_ble_gap_cb_param_t *)msg->arg)->cs_subevt_result.step_info; if (step_info) { @@ -2595,7 +2714,7 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg) } } break; - case BTA_BLE_GAP_CS_SUBEVENT_RESULT_CONTINUE_EVT: + case ESP_GAP_BLE_CS_SUBEVENT_RESULT_CONTINUE_EVT: { esp_ble_cs_step_info *step_info = ((esp_ble_gap_cb_param_t *)msg->arg)->cs_subevt_result_continue.step_info; if (step_info) { @@ -2630,31 +2749,27 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) #if (BLE_42_FEATURE_SUPPORT == TRUE) #if (BLE_42_ADV_EN == TRUE) case BTC_GAP_BLE_ACT_CFG_ADV_DATA: { - if (arg->cfg_adv_data.adv_data.set_scan_rsp == false) { - btc_ble_set_adv_data(&arg->cfg_adv_data.adv_data, btc_adv_data_callback); - } else { - btc_ble_set_adv_data(&arg->cfg_adv_data.adv_data, btc_scan_rsp_data_callback); - } + btc_ble_set_adv_data(&arg->cfg_adv_data.adv_data); break; } #endif // #if (BLE_42_ADV_EN == TRUE) #if (BLE_42_SCAN_EN == TRUE) case BTC_GAP_BLE_ACT_SET_SCAN_PARAM: - btc_ble_set_scan_params(&arg->set_scan_param.scan_params, btc_scan_params_callback); + btc_ble_set_scan_params(&arg->set_scan_param.scan_params); break; case BTC_GAP_BLE_ACT_START_SCAN: - btc_ble_start_scanning(arg->start_scan.duration, btc_search_callback, btc_start_scan_callback); + btc_ble_start_scanning(arg->start_scan.duration, btc_search_callback); break; case BTC_GAP_BLE_ACT_STOP_SCAN: - btc_ble_stop_scanning(btc_stop_scan_callback); + btc_ble_stop_scanning(); break; #endif // #if (BLE_42_SCAN_EN == TRUE) #if (BLE_42_ADV_EN == TRUE) case BTC_GAP_BLE_ACT_START_ADV: - btc_ble_start_advertising(&arg->start_adv.adv_params, btc_start_adv_callback); + btc_ble_start_advertising(&arg->start_adv.adv_params); break; case BTC_GAP_BLE_ACT_STOP_ADV: - btc_ble_stop_advertising(btc_stop_adv_callback); + btc_ble_stop_advertising(); break; #endif // #if (BLE_42_ADV_EN == TRUE) #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE) @@ -2666,23 +2781,22 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) arg->conn_update_params.conn_params.timeout); break; case BTC_GAP_BLE_ACT_SET_PKT_DATA_LEN: - btc_ble_set_pkt_data_len(arg->set_pkt_data_len.remote_device, arg->set_pkt_data_len.tx_data_length, btc_set_pkt_length_callback); + btc_ble_set_pkt_data_len(arg->set_pkt_data_len.remote_device, arg->set_pkt_data_len.tx_data_length); break; case BTC_GAP_BLE_ACT_SET_RAND_ADDRESS: { BD_ADDR bd_addr; memcpy(bd_addr, arg->set_rand_addr.rand_addr, sizeof(BD_ADDR)); - btc_ble_set_rand_addr(bd_addr, btc_set_rand_addr_callback); + btc_ble_set_rand_addr(bd_addr); break; } case BTC_GAP_BLE_ACT_SET_RESOLVABLE_PRIVATE_ADDRESS_TIMEOUT: { - btc_ble_set_rpa_timeout(arg->set_rpa_timeout.rpa_timeout,btc_set_rpa_timeout_callback); + btc_ble_set_rpa_timeout(arg->set_rpa_timeout.rpa_timeout); break; } case BTC_GAP_BLE_ACT_ADD_DEVICE_TO_RESOLVING_LIST: { btc_ble_add_device_to_resolving_list(arg->add_dev_to_resolving_list.addr, arg->add_dev_to_resolving_list.addr_type, - arg->add_dev_to_resolving_list.irk, - btc_add_dev_to_resolving_list_callback); + arg->add_dev_to_resolving_list.irk); break; } case BTC_GAP_BLE_ACT_CLEAR_RAND_ADDRESS: { @@ -2690,22 +2804,22 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) break; } case BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY: - btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable, btc_set_local_privacy_callback); + btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable); break; case BTC_GAP_BLE_ACT_CONFIG_LOCAL_ICON: btc_ble_config_local_icon(arg->cfg_local_icon.icon); break; case BTC_GAP_BLE_ACT_UPDATE_WHITE_LIST: - BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, arg->update_white_list.wl_addr_type, btc_update_whitelist_complete_callback); + BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, arg->update_white_list.wl_addr_type); break; case BTC_GAP_BLE_ACT_CLEAR_WHITE_LIST: - BTA_DmClearWhiteList(btc_update_whitelist_complete_callback); + BTA_DmClearWhiteList(); break; case BTC_GAP_BLE_ACT_READ_RSSI: BTA_DmReadRSSI(arg->read_rssi.remote_addr, BTA_TRANSPORT_LE, btc_read_ble_rssi_cmpl_callback); break; case BTC_GAP_BLE_READ_CHANNEL_MAP: - BTA_DmBleReadChannelMap(arg->read_channel_map.bd_addr, btc_ble_read_channel_map_callback); + BTA_DmBleReadChannelMap(arg->read_channel_map.bd_addr); break; #if (BLE_42_FEATURE_SUPPORT == TRUE) case BTC_GAP_BLE_ACT_SET_CONN_PARAMS: @@ -2724,13 +2838,11 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) #if (BLE_42_ADV_EN == TRUE) case BTC_GAP_BLE_ACT_CFG_ADV_DATA_RAW: btc_ble_set_adv_data_raw(arg->cfg_adv_data_raw.raw_adv, - arg->cfg_adv_data_raw.raw_adv_len, - btc_adv_data_raw_callback); + arg->cfg_adv_data_raw.raw_adv_len); break; case BTC_GAP_BLE_ACT_CFG_SCAN_RSP_DATA_RAW: btc_ble_set_scan_rsp_data_raw(arg->cfg_scan_rsp_data_raw.raw_scan_rsp, - arg->cfg_scan_rsp_data_raw.raw_scan_rsp_len, - btc_scan_rsp_data_raw_callback); + arg->cfg_scan_rsp_data_raw.raw_scan_rsp_len); break; #endif // #if (BLE_42_ADV_EN == TRUE) #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE) @@ -2739,8 +2851,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) case BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST: btc_ble_update_duplicate_exceptional_list(arg->update_duplicate_exceptional_list.subcode, arg->update_duplicate_exceptional_list.info_type, - arg->update_duplicate_exceptional_list.device_info, - btc_update_duplicate_exceptional_list_callback); + arg->update_duplicate_exceptional_list.device_info); break; #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) @@ -2832,14 +2943,14 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) } case BTC_GAP_BLE_PASSKEY_REPLY_EVT: { BD_ADDR bd_addr; - memcpy(bd_addr, arg->enc_passkey_replay.bd_addr, sizeof(BD_ADDR)); - BTA_DmBlePasskeyReply(bd_addr, arg->enc_passkey_replay.accept, arg->enc_passkey_replay.passkey); + memcpy(bd_addr, arg->enc_passkey_reply.bd_addr, sizeof(BD_ADDR)); + BTA_DmBlePasskeyReply(bd_addr, arg->enc_passkey_reply.accept, arg->enc_passkey_reply.passkey); break; } case BTC_GAP_BLE_CONFIRM_REPLY_EVT: { BD_ADDR bd_addr; - memcpy(bd_addr, arg->enc_comfirm_replay.bd_addr, sizeof(BD_ADDR)); - BTA_DmBleConfirmReply(bd_addr, arg->enc_comfirm_replay.accept); + memcpy(bd_addr, arg->enc_confirm_reply.bd_addr, sizeof(BD_ADDR)); + BTA_DmBleConfirmReply(bd_addr, arg->enc_confirm_reply.accept); break; } case BTC_GAP_BLE_REMOVE_BOND_DEV_EVT: { @@ -3131,11 +3242,11 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) #endif // #if (BLE_50_DTM_TEST_EN == TRUE) case BTC_GAP_BLE_SET_PRIVACY_MODE: btc_ble_set_privacy_mode(arg->set_privacy_mode.addr_type, arg->set_privacy_mode.addr, - arg->set_privacy_mode.privacy_mode, btc_ble_set_privacy_mode_callback); + arg->set_privacy_mode.privacy_mode); break; #if (BLE_VENDOR_HCI_EN == TRUE) case BTC_GAP_BLE_ACT_CLEAR_ADV: - BTA_DmBleClearAdv(btc_clear_adv_callback); + BTA_DmBleClearAdv(); break; case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: BTA_DmsendVendorHciCmd(arg->vendor_cmd_send.opcode, @@ -3144,10 +3255,10 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) btc_ble_vendor_hci_cmd_complete_callback); break; case BTC_GAP_BLE_SET_CSA_SUPPORT: - BTA_DmBleGapSetCsaSupport(arg->set_csa_support.csa_select, btc_ble_set_csa_support_callback); + BTA_DmBleGapSetCsaSupport(arg->set_csa_support.csa_select); break; case BTC_GAP_BLE_ACT_SET_VENDOR_EVT_MASK: - BTA_DmBleGapSetVendorEventMask(arg->set_vendor_evt_mask.evt_mask, btc_ble_set_vendor_evt_mask_callback); + BTA_DmBleGapSetVendorEventMask(arg->set_vendor_evt_mask.evt_mask); break; #endif // #if (BLE_VENDOR_HCI_EN == TRUE) #if (BLE_FEAT_POWER_CONTROL_EN == TRUE) @@ -3268,11 +3379,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) //register connection parameter update callback void btc_gap_callback_init(void) { - BTM_BleRegiseterPktLengthChangeCallback(btc_set_pkt_length_callback); - BTM_BleRegiseterConnParamCallback(btc_update_conn_param_callback); #if (BLE_50_FEATURE_SUPPORT == TRUE) BTM_BleGapRegisterCallback(btc_ble_5_gap_callback); #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) + + BTM_BleLegacyGapRegisterCallback(btc_ble_legacy_gap_callback); + #if (BLE_VENDOR_HCI_EN == TRUE) BTM_BleRegisterVendorHciEventCallback(btc_ble_vendor_hci_event_callback); #endif // #if (BLE_VENDOR_HCI_EN == TRUE) diff --git a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c index 9d4d108bef6..9d8ee85412a 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c +++ b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -27,6 +27,10 @@ int uuidType(unsigned char *p_uuid) int all_zero = 1; for (i = 0; i != 16; ++i) { + /* Check if bytes 12-13 are non-zero for all_zero detection */ + if (p_uuid[i] != 0) { + all_zero = 0; + } if (i == 12 || i == 13) { continue; } @@ -34,10 +38,6 @@ int uuidType(unsigned char *p_uuid) if (p_uuid[i] == BASE_UUID[i]) { ++match; } - - if (p_uuid[i] != 0) { - all_zero = 0; - } } if (all_zero) { return 0; @@ -114,9 +114,11 @@ void btc_to_bta_response(tBTA_GATTS_RSP *p_dest, esp_gatt_rsp_t *p_src) { p_dest->attr_value.auth_req = p_src->attr_value.auth_req; p_dest->attr_value.handle = p_src->attr_value.handle; - p_dest->attr_value.len = p_src->attr_value.len; p_dest->attr_value.offset = p_src->attr_value.offset; - memcpy(p_dest->attr_value.value, p_src->attr_value.value, ESP_GATT_MAX_ATTR_LEN); + uint16_t copy_len = (p_src->attr_value.len <= ESP_GATT_MAX_ATTR_LEN) + ? p_src->attr_value.len : ESP_GATT_MAX_ATTR_LEN; + p_dest->attr_value.len = copy_len; /* match actual bytes copied (defensive if src len > buffer) */ + memcpy(p_dest->attr_value.value, p_src->attr_value.value, copy_len); } uint16_t get_uuid16(tBT_UUID *p_uuid) @@ -146,13 +148,18 @@ uint16_t set_read_value(uint8_t *gattc_if, esp_ble_gattc_cb_param_t *p_dest, tBT if (( p_src->status == BTA_GATT_OK ) && (p_src->p_value != NULL)) { BTC_TRACE_DEBUG("%s len = %d ", __func__, p_src->p_value->len); - p_dest->read.value_len = p_src->p_value->len; if ( p_src->p_value->len > 0 && p_src->p_value->p_value != NULL ) { + p_dest->read.value_len = p_src->p_value->len; p_dest->read.value = p_src->p_value->p_value; + len += p_src->p_value->len; + } else { + /* len>0 but p_value==NULL would leave value uninitialized; avoid that */ + p_dest->read.value_len = 0; + p_dest->read.value = NULL; } - len += p_src->p_value->len; } else { p_dest->read.value_len = 0; + p_dest->read.value = NULL; } return len; diff --git a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c index 07e5fd1b82e..4882584baa4 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c +++ b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c @@ -40,6 +40,7 @@ void btc_gattc_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->write_char.value, src->write_char.value, src->write_char.value_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->write_char.value_len = 0; } break; } @@ -49,6 +50,7 @@ void btc_gattc_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->write_descr.value, src->write_descr.value, src->write_descr.value_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->write_descr.value_len = 0; } break; } @@ -58,6 +60,7 @@ void btc_gattc_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->prep_write.value, src->prep_write.value, src->prep_write.value_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->prep_write.value_len = 0; } break; } @@ -67,6 +70,7 @@ void btc_gattc_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->prep_write_descr.value, src->prep_write_descr.value, src->prep_write_descr.value_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->prep_write_descr.value_len = 0; } break; } @@ -337,6 +341,11 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc tBT_UUID *bta_uuid = NULL; if (svc_uuid) { bta_uuid = osi_malloc(sizeof(tBT_UUID)); + if (bta_uuid == NULL) { + *count = 0; + return ESP_GATT_NO_RESOURCES; + } + btc_to_bta_uuid(bta_uuid, svc_uuid); } @@ -621,16 +630,16 @@ static void btc_gattc_read_char(btc_ble_gattc_args_t *arg) static void btc_gattc_read_multiple_char(btc_ble_gattc_args_t *arg) { tBTA_GATTC_MULTI bta_multi; - bta_multi.num_attr = arg->read_multiple.num_attr; - memcpy(bta_multi.handles, arg->read_multiple.handles, BTA_GATTC_MULTI_MAX); + bta_multi.num_attr = (arg->read_multiple.num_attr > BTA_GATTC_MULTI_MAX) ? BTA_GATTC_MULTI_MAX : arg->read_multiple.num_attr; + memcpy(bta_multi.handles, arg->read_multiple.handles, sizeof(uint16_t) * bta_multi.num_attr); BTA_GATTC_ReadMultiple(arg->read_multiple.conn_id, &bta_multi, arg->read_multiple.auth_req); } static void btc_gattc_read_multiple_variable_char(btc_ble_gattc_args_t *arg) { tBTA_GATTC_MULTI bta_multi; - bta_multi.num_attr = arg->read_multiple.num_attr; - memcpy(bta_multi.handles, arg->read_multiple.handles, BTA_GATTC_MULTI_MAX); + bta_multi.num_attr = (arg->read_multiple.num_attr > BTA_GATTC_MULTI_MAX) ? BTA_GATTC_MULTI_MAX : arg->read_multiple.num_attr; + memcpy(bta_multi.handles, arg->read_multiple.handles, sizeof(uint16_t) * bta_multi.num_attr); BTA_GATTC_ReadMultipleVariable(arg->read_multiple.conn_id, &bta_multi, arg->read_multiple.auth_req); } @@ -681,7 +690,11 @@ static void btc_gattc_prepare_write(btc_ble_gattc_args_t *arg) static void btc_gattc_prepare_write_char_descr(btc_ble_gattc_args_t *arg) { tBTA_GATT_UNFMT descr_val; - + /* + According to the Bluetooth Core Specification, a Prepare Write Request can have a zero-length value. + The underlying BTA layer function BTA_GATTC_PrepareWriteCharDescr is implemented to handle zero-length data correctly by skipping the memory copy + but still sending the message to the stack. + */ descr_val.len = arg->prep_write_descr.value_len; descr_val.p_value = arg->prep_write_descr.value; BTA_GATTC_PrepareWriteCharDescr(arg->prep_write_descr.conn_id, diff --git a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c index a638de69111..6f9f50d3bd4 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c +++ b/components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -31,7 +31,7 @@ esp_btc_creat_tab_t *btc_creat_tab_env_ptr; #endif static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, - uint8_t max_nb_attr); + uint16_t max_nb_attr); static inline void btc_gatts_cb_to_app(esp_gatts_cb_event_t event, esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param) { @@ -42,6 +42,14 @@ static inline void btc_gatts_cb_to_app(esp_gatts_cb_event_t event, esp_gatt_if_t } } +/* Report CREAT_ATTR_TAB error to app and reset env; use on all early-exit error paths in btc_gatts_act_create_attr_tab */ +static void btc_gatts_creat_tab_fail_and_cleanup(esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param) +{ + param->add_attr_tab.status = ESP_GATT_ERROR; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, param); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); +} + static inline void btc_gatts_uuid_format_convert(esp_bt_uuid_t* dest_uuid, uint16_t src_uuid_len, uint8_t* src_uuid_p) { dest_uuid->len = src_uuid_len; @@ -74,9 +82,11 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->send_ind.value, src->send_ind.value, src->send_ind.value_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->send_ind.value_len = 0; } } else { dst->send_ind.value = NULL; + dst->send_ind.value_len = 0; if (src->send_ind.value) { BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act); } @@ -103,9 +113,11 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) src->add_char.char_val.attr_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->add_char.char_val.attr_len = 0; } } else { dst->add_char.char_val.attr_value = NULL; + dst->add_char.char_val.attr_len = 0; if (src->add_char.char_val.attr_value) { BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act); } @@ -120,9 +132,11 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) src->add_descr.descr_val.attr_len); } else { BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act); + dst->add_descr.descr_val.attr_len = 0; } } else { dst->add_descr.descr_val.attr_value = NULL; + dst->add_descr.descr_val.attr_len = 0; if (src->add_descr.descr_val.attr_value) { BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act); } @@ -138,8 +152,11 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) sizeof(esp_gatts_attr_db_t) * num_attr); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->create_attr_tab.max_nb_attr = 0; } } else { + dst->create_attr_tab.gatts_attr_db = NULL; + dst->create_attr_tab.max_nb_attr = 0; BTC_TRACE_ERROR("%s %d, NULL data", __func__, msg->act); } break; @@ -151,9 +168,11 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->set_attr_val.value, src->set_attr_val.value, src->set_attr_val.length); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->set_attr_val.length = 0; } } else { dst->set_attr_val.value = NULL; + dst->set_attr_val.length = 0; if (src->set_attr_val.value) { BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act); } else { @@ -289,11 +308,13 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); //reset the env after sent the data to app memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); return; } if (future_await(future_p) == FUTURE_FAIL) { BTC_TRACE_ERROR("%s failed\n", __func__); + btc_gatts_creat_tab_fail_and_cleanup(gatts_if, ¶m); return; } break; @@ -316,10 +337,12 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); //reset the env after sent the data to app memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); return; } if (future_await(future_p) == FUTURE_FAIL) { BTC_TRACE_ERROR("%s failed\n", __func__); + btc_gatts_creat_tab_fail_and_cleanup(gatts_if, ¶m); return; } break; @@ -334,9 +357,24 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, if (future_await(future_p) == FUTURE_FAIL) { BTC_TRACE_ERROR("%s failed\n", __func__); + btc_gatts_creat_tab_fail_and_cleanup(gatts_if, ¶m); return; } + } else { + /* svc_start_hdl == 0: service not created, report error and return */ + param.add_attr_tab.status = ESP_GATT_ERROR; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; } + } else { + /* incl_svc_desc == NULL: no BTA call, future never completed; report error and return */ + param.add_attr_tab.status = ESP_GATT_INVALID_PDU; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; } break; } @@ -353,6 +391,20 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, svc_hal = btc_creat_tab_env.svc_start_hdl; if((gatts_attr_db[i].att_desc.value) == NULL){ BTC_TRACE_ERROR("%s Characteristic declaration should not be NULL\n", __func__); + param.add_attr_tab.status = ESP_GATT_INVALID_PDU; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; + } + else if (i + 1 >= max_nb_attr) { + BTC_TRACE_ERROR("%s Characteristic declaration at index %d missing value attribute\n", + __func__, i); + param.add_attr_tab.status = ESP_GATT_INVALID_PDU; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; } else{ char_property = (uint8_t)(*(uint8_t*)(gatts_attr_db[i].att_desc.value)); @@ -368,10 +420,18 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, if (future_await(future_p) == FUTURE_FAIL) { BTC_TRACE_ERROR("%s failed\n", __func__); + btc_gatts_creat_tab_fail_and_cleanup(gatts_if, ¶m); return; } skip_next_attr_row = true; } + } else { + /* svc_start_hdl == 0: service not created, report error and return */ + param.add_attr_tab.status = ESP_GATT_ERROR; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; } break; @@ -411,8 +471,16 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, if (future_await(future_p) == FUTURE_FAIL) { BTC_TRACE_ERROR("%s failed\n", __func__); + btc_gatts_creat_tab_fail_and_cleanup(gatts_if, ¶m); return; } + } else { + /* svc_start_hdl == 0: service not created, report error and return */ + param.add_attr_tab.status = ESP_GATT_ERROR; + btc_gatts_cb_to_app(ESP_GATTS_CREAT_ATTR_TAB_EVT, gatts_if, ¶m); + memset(&btc_creat_tab_env, 0, sizeof(esp_btc_creat_tab_t)); + future_free(future_p); + return; } break; } @@ -435,9 +503,9 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, } static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gatts_attr_db, - uint8_t max_nb_attr) + uint16_t max_nb_attr) { - uint8_t svc_num = 0; + uint16_t svc_num = 0; uint16_t uuid = 0; for(int i = 0; i < max_nb_attr; i++) { @@ -468,8 +536,8 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat break; } case ESP_GATT_UUID_CHAR_DECLARE: - if((gatts_attr_db[i].att_desc.value) == NULL) { - BTC_TRACE_ERROR("%s, Characteristic declaration should not be NULL.", __func__); + if((gatts_attr_db[i].att_desc.value) == NULL || ((i + 1) >= max_nb_attr)) { + BTC_TRACE_ERROR("%s, att_desc.value is NULL or (%d + 1) >= %d", __func__, i, max_nb_attr); return ESP_GATT_INVALID_PDU; } @@ -596,7 +664,12 @@ static void btc_gatts_inter_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data) case BTA_GATTS_ADD_CHAR_EVT: { uint16_t index = btc_creat_tab_env.handle_idx; btc_creat_tab_env.handles[index] = p_data->add_result.attr_id - 1; - btc_creat_tab_env.handles[index+1] = p_data->add_result.attr_id; + if (index + 1 < btc_creat_tab_env.num_handle) { + btc_creat_tab_env.handles[index+1] = p_data->add_result.attr_id; + } else { + BTC_TRACE_ERROR("%s handles[%d+1] out of bounds (num_handle=%d)", + __func__, index, btc_creat_tab_env.num_handle); + } break; } case BTA_GATTS_ADD_CHAR_DESCR_EVT: { @@ -794,6 +867,10 @@ void btc_gatts_cb_handler(btc_msg_t *msg) param.read.conn_id = BTC_GATT_GET_CONN_ID(p_data->req_data.conn_id); param.read.trans_id = p_data->req_data.trans_id; memcpy(param.read.bda, p_data->req_data.remote_bda, ESP_BD_ADDR_LEN); + if (p_data->req_data.p_data == NULL) { + BTC_TRACE_ERROR("%s READ_EVT p_data NULL", __func__); + break; + } param.read.handle = p_data->req_data.p_data->read_req.handle; param.read.offset = p_data->req_data.p_data->read_req.offset; param.read.is_long = p_data->req_data.p_data->read_req.is_long; @@ -822,23 +899,26 @@ void btc_gatts_cb_handler(btc_msg_t *msg) break; } case BTA_GATTS_EXEC_WRITE_EVT: { + if (p_data->req_data.p_data == NULL) { + break; + } gatts_if = BTC_GATT_GET_GATT_IF(p_data->req_data.conn_id); param.exec_write.conn_id = BTC_GATT_GET_CONN_ID(p_data->req_data.conn_id); param.exec_write.trans_id = p_data->req_data.trans_id; memcpy(param.exec_write.bda, p_data->req_data.remote_bda, ESP_BD_ADDR_LEN); - if (p_data->req_data.p_data == NULL) { - break; - } param.exec_write.exec_write_flag = p_data->req_data.p_data->exec_write; btc_gatts_cb_to_app(ESP_GATTS_EXEC_WRITE_EVT, gatts_if, ¶m); break; } case BTA_GATTS_MTU_EVT: + if (p_data->req_data.p_data == NULL) { + BTC_TRACE_ERROR("%s MTU_EVT p_data NULL", __func__); + break; + } gatts_if = BTC_GATT_GET_GATT_IF(p_data->req_data.conn_id); param.mtu.conn_id = BTC_GATT_GET_CONN_ID(p_data->req_data.conn_id); param.mtu.mtu = p_data->req_data.p_data->mtu; - btc_gatts_cb_to_app(ESP_GATTS_MTU_EVT, gatts_if, ¶m); break; case BTA_GATTS_CONF_EVT: diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_ble_cte.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_ble_cte.h index 659bfb31993..161955ac77e 100644 --- a/components/bt/host/bluedroid/btc/profile/std/include/btc_ble_cte.h +++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_ble_cte.h @@ -76,12 +76,12 @@ typedef union { uint8_t req_cte_len; uint8_t req_cte_Type; } cte_req_en; -#endif // #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) struct cte_rsp_en_arg { uint16_t conn_handle; uint8_t enable; } cte_rsp_en; +#endif // #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) } btc_ble_cte_args_t; diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h index 2e6163eb2f3..306adb09a14 100644 --- a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h +++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h @@ -294,12 +294,12 @@ typedef union { esp_bd_addr_t bd_addr; bool accept; uint32_t passkey; - } enc_passkey_replay; + } enc_passkey_reply; //BTC_GAP_BLE_CONFIRM_REPLY_EVT struct enc_comfirm_reply_args { esp_bd_addr_t bd_addr; bool accept; - } enc_comfirm_replay; + } enc_confirm_reply; //BTC_GAP_BLE_OOB_DATA_REPLY_EVT struct oob_req_reply_args { esp_bd_addr_t bd_addr; @@ -520,12 +520,12 @@ typedef union { #if (BLE_FEAT_POWER_CONTROL_EN == TRUE) // BTC_GAP_BLE_ENH_READ_TRANS_POWER_LEVEL struct enh_read_trans_pwr_level_args { - uint8_t conn_handle; + uint16_t conn_handle; uint8_t phy; } enh_read_trans_pwr_level; // BTC_GAP_BLE_READ_REM_TRANS_POWER_LEVEL struct read_rem_trans_pwr_level_args { - uint8_t conn_handle; + uint16_t conn_handle; uint8_t phy; } read_rem_trans_pwr_level; // BTC_GAP_BLE_SET_PATH_LOSS_REPORT_PARAMS diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_iso_ble.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_iso_ble.h index 4e734b12026..6b51941c480 100644 --- a/components/bt/host/bluedroid/btc/profile/std/include/btc_iso_ble.h +++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_iso_ble.h @@ -41,11 +41,11 @@ struct btc_iso_cis_hdls { }__attribute__((packed)); typedef enum { -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) BTC_ISO_ACT_BIG_CREATE, BTC_ISO_ACT_BIG_CREATE_TEST, BTC_ISO_ACT_BIG_TERMINATE, -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) BTC_ISO_ACT_BIG_SYNC_CREATE, BTC_ISO_ACT_BIG_SYNC_TERMINATE, @@ -71,7 +71,7 @@ typedef enum { /* btc_ble_iso_args_t */ typedef union { -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) struct iso_big_create_args { uint8_t big_handle; uint8_t adv_handle; @@ -110,7 +110,7 @@ typedef union { uint8_t big_handle; uint8_t reason; } iso_big_terminate_params; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) struct iso_big_sync_creat_arg { diff --git a/components/bt/host/bluedroid/btc/profile/std/iso/btc_iso_ble.c b/components/bt/host/bluedroid/btc/profile/std/iso/btc_iso_ble.c index 825d9563013..572d7cc24ae 100644 --- a/components/bt/host/bluedroid/btc/profile/std/iso/btc_iso_ble.c +++ b/components/bt/host/bluedroid/btc/profile/std/iso/btc_iso_ble.c @@ -27,14 +27,14 @@ static inline void btc_iso_ble_cb_to_app(esp_ble_iso_cb_event_t event, esp_ble_i static void btc_ble_iso_callback(tBTM_BLE_ISO_EVENT event, tBTM_BLE_ISO_CB_PARAMS *params) { - esp_ble_iso_cb_param_t param; + esp_ble_iso_cb_param_t param = {0}; bt_status_t ret; btc_msg_t msg; msg.sig = BTC_SIG_API_CB; msg.pid = BTC_PID_ISO_BLE; switch(event) { -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) case BTA_BLE_ISO_BIG_CREATE_COMPLETE_EVT: msg.act = ESP_BLE_ISO_BIG_CREATE_CMPL_EVT; param.create_big_cmpl.status = btc_btm_status_to_esp_status(params->btm_big_cmpl.status); @@ -60,7 +60,7 @@ static void btc_ble_iso_callback(tBTM_BLE_ISO_EVENT event, param.term_big_cmpl.big_handle = params->btm_big_term.big_handle; param.term_big_cmpl.reason = params->btm_big_term.reason; break; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) case BTA_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT: msg.act = ESP_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT; @@ -244,6 +244,7 @@ void btc_iso_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src) memcpy(dst->iso_set_data_path_params.codec_cfg, src->iso_set_data_path_params.codec_cfg, src->iso_set_data_path_params.codec_cfg_len); } else { BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act); + dst->iso_set_data_path_params.codec_cfg_len = 0; } } break; @@ -300,7 +301,7 @@ void btc_iso_ble_call_handler(btc_msg_t *msg) BTC_TRACE_DEBUG("%s act %d\n", __FUNCTION__, msg->act); switch (msg->act) { -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) case BTC_ISO_ACT_BIG_CREATE: BTA_DmBleGapIsoBigCreate((tBTA_DM_BLE_BIG_CREATE_PARAMS *)&arg->iso_big_creat_params); break; @@ -310,7 +311,7 @@ void btc_iso_ble_call_handler(btc_msg_t *msg) case BTC_ISO_ACT_BIG_TERMINATE: BTA_DmBleGapIsoBigTerminate((tBTA_DM_BLE_BIG_TERMINATE_PARAMS *)&arg->iso_big_terminate_params); break; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) case BTC_ISO_ACT_BIG_SYNC_CREATE: BTA_DmBleGapIsoBigSyncCreate((tBTA_DM_BLE_BIG_SYNC_CREATE_PARAMS *)&arg->iso_big_sync_creat_params); @@ -329,6 +330,7 @@ void btc_iso_ble_call_handler(btc_msg_t *msg) BTA_DmBleGapIsoReadTxSync(arg->iso_read_tx_sync_params.iso_handle); break; case BTC_ISO_ACT_READ_ISO_LINK_QUALITY: + BTA_DmBleGapIsoReadLinkQuality(arg->iso_read_link_quality_params.iso_handle); break; #if (BLE_FEAT_ISO_CIG_CENTRAL_EN == TRUE) case BTC_ISO_ACT_SET_CIG_PARAMS: { diff --git a/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h b/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h index 9c51d718afe..36d39b8a654 100644 --- a/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h +++ b/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h @@ -279,9 +279,9 @@ #endif #ifdef CONFIG_BT_BLE_FEAT_ISO_BIG_BROCASTER -#define UC_BT_BLE_FEAT_ISO_BIG_BROCASTER CONFIG_BT_BLE_FEAT_ISO_BIG_BROCASTER +#define UC_BT_BLE_FEAT_ISO_BIG_BROADCASTER CONFIG_BT_BLE_FEAT_ISO_BIG_BROCASTER #else -#define UC_BT_BLE_FEAT_ISO_BIG_BROCASTER FALSE +#define UC_BT_BLE_FEAT_ISO_BIG_BROADCASTER FALSE #endif #ifdef CONFIG_BT_BLE_FEAT_ISO_CIG_CENTRAL diff --git a/components/bt/host/bluedroid/common/include/common/bt_target.h b/components/bt/host/bluedroid/common/include/common/bt_target.h index 5278fa5ec84..e8bb2d68830 100644 --- a/components/bt/host/bluedroid/common/include/common/bt_target.h +++ b/components/bt/host/bluedroid/common/include/common/bt_target.h @@ -316,10 +316,10 @@ #define BLE_FEAT_ISO_60_EN FALSE #endif -#if (UC_BT_BLE_FEAT_ISO_BIG_BROCASTER == TRUE) -#define BLE_FEAT_ISO_BIG_BROCASTER_EN TRUE +#if (UC_BT_BLE_FEAT_ISO_BIG_BROADCASTER == TRUE) +#define BLE_FEAT_ISO_BIG_BROADCASTER_EN TRUE #else -#define BLE_FEAT_ISO_BIG_BROCASTER_EN FALSE +#define BLE_FEAT_ISO_BIG_BROADCASTER_EN FALSE #endif #if (UC_BT_BLE_FEAT_ISO_BIG_SYNCER == TRUE) @@ -657,10 +657,6 @@ #define BTA_DM_QOS_INCLUDED FALSE #endif -#ifndef BTA_PAN_INCLUDED -#define BTA_PAN_INCLUDED FALSE -#endif - #ifndef BTA_HD_INCLUDED #define BTA_HD_INCLUDED FALSE #endif diff --git a/components/bt/host/bluedroid/device/controller.c b/components/bt/host/bluedroid/device/controller.c index ac0bf4dc16a..d090c7b33f4 100644 --- a/components/bt/host/bluedroid/device/controller.c +++ b/components/bt/host/bluedroid/device/controller.c @@ -546,7 +546,7 @@ static uint8_t get_ble_resolving_list_max_size(void) return controller_param.ble_resolving_list_max_size; } -static void set_ble_resolving_list_max_size(int resolving_list_max_size) +static void set_ble_resolving_list_max_size(uint8_t resolving_list_max_size) { assert(controller_param.readable); assert(controller_param.ble_supported); diff --git a/components/bt/host/bluedroid/device/include/device/controller.h b/components/bt/host/bluedroid/device/include/device/controller.h index 6345d7a9c9a..610c9afafc7 100644 --- a/components/bt/host/bluedroid/device/include/device/controller.h +++ b/components/bt/host/bluedroid/device/include/device/controller.h @@ -78,7 +78,7 @@ typedef struct controller_t { uint8_t (*get_ble_white_list_size)(void); uint8_t (*get_ble_resolving_list_max_size)(void); - void (*set_ble_resolving_list_max_size)(int resolving_list_max_size); + void (*set_ble_resolving_list_max_size)(uint8_t resolving_list_max_size); #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_50_EXTEND_ADV_EN == TRUE) diff --git a/components/bt/host/bluedroid/hci/ble_hci_iso.c b/components/bt/host/bluedroid/hci/ble_hci_iso.c index 6a61836ef21..92db66d3110 100644 --- a/components/bt/host/bluedroid/hci/ble_hci_iso.c +++ b/components/bt/host/bluedroid/hci/ble_hci_iso.c @@ -79,33 +79,6 @@ ble_hci_set_iso_buf_sz(uint16_t pktlen, uint8_t max_pkts) return 0; } -void -ble_hci_get_iso_buf_size(uint16_t *pktlen, uint8_t *max_pkts) -{ - assert(pktlen && max_pkts); - - *pktlen = ble_hs_iso_buf_sz; - *max_pkts = ble_hs_iso_max_pkts; -} - -#if (BLE_ISO_STD_FLOW_CTRL == TRUE) -void -ble_hci_add_iso_avail_pkts(uint16_t delta) -{ - osi_mutex_global_lock(); - - if (ble_hs_iso_avail_pkts + delta > ble_hs_iso_max_pkts) { - HCI_TRACE_ERROR("ISO_HS_RESET %u %u %u\n", ble_hs_iso_avail_pkts, delta, ble_hs_iso_max_pkts); - // ble_hs_sched_reset(BLE_HS_ECONTROLLER); - assert(0); - } else { - ble_hs_iso_avail_pkts += delta; - } - - osi_mutex_global_unlock(); -} -#endif /* (BLE_ISO_STD_FLOW_CTRL) */ - #define BLE_ARRAY_SIZE(x) (sizeof(x)/sizeof((x)[0])) struct ble_hci_iso_conn * @@ -156,39 +129,6 @@ ble_hci_iso_alloc_conn(uint16_t conn_handle) return NULL; } -#if (BLE_ISO_STD_FLOW_CTRL == TRUE) -static uint8_t -ble_hci_iso_buf_needed(struct ble_hs_iso_conn *conn) -{ - uint16_t sdu_offset; - uint16_t dl_len; - uint8_t dlh_len; - uint8_t count; - - dlh_len = (conn->ts_flag ? BLE_HCI_ISO_DATA_LOAD_TS_SZ : 0) + BLE_HCI_ISO_DATA_LOAD_HDR_SZ; - sdu_offset = 0; - count = 1; /* 1 extra since framed pdu may be used */ - - while (1) { - dl_len = min(dlh_len + conn->sdu_len - sdu_offset, ble_hs_iso_buf_sz); - - count += 1; - - sdu_offset += dl_len - dlh_len; - assert(sdu_offset <= conn->sdu_len); - - if (sdu_offset == conn->sdu_len) { - break; - } - - /* No data load header for continuation/last segment */ - dlh_len = 0; - } - - return count; -} -#endif /* (BLE_ISO_STD_FLOW_CTRL) */ - static void ble_hci_iso_hdr_append(struct ble_hci_iso_conn *conn, uint8_t *frag, diff --git a/components/bt/host/bluedroid/hci/hci_hal_h4.c b/components/bt/host/bluedroid/hci/hci_hal_h4.c index a8f78aae331..5e7c116d545 100644 --- a/components/bt/host/bluedroid/hci/hci_hal_h4.c +++ b/components/bt/host/bluedroid/hci/hci_hal_h4.c @@ -34,7 +34,6 @@ #include "esp_bt.h" #endif #include "esp_bluedroid_hci.h" -#include "stack/hcimsgs.h" #if (C2H_FLOW_CONTROL_INCLUDED == TRUE) #include "l2c_int.h" @@ -318,9 +317,12 @@ static void hci_packet_complete(BT_HDR *packet){ } #endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE -bool host_recv_adv_packet(uint8_t *packet) +bool host_recv_adv_packet(uint8_t *packet, uint16_t len) { assert(packet); + if (len < 4) { + return false; + } if(packet[0] == DATA_TYPE_EVENT && packet[1] == HCI_BLE_EVENT) { if(packet[3] == HCI_BLE_ADV_PKT_RPT_EVT || packet[3] == HCI_BLE_DIRECT_ADV_EVT #if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE) @@ -356,7 +358,8 @@ int hci_adv_credits_prep_to_release(uint16_t num) osi_mutex_lock(&hci_hal_env.adv_flow_lock, OSI_MUTEX_MAX_TIMEOUT); int credits_to_release = hci_hal_env.adv_credits_to_release + num; - assert(hci_hal_env.adv_credits_to_release <= BLE_ADV_REPORT_FLOW_CONTROL_NUM); + assert(num <= BLE_ADV_REPORT_FLOW_CONTROL_NUM); + assert(credits_to_release >= 0 && credits_to_release <= BLE_ADV_REPORT_FLOW_CONTROL_NUM); hci_hal_env.adv_credits_to_release = credits_to_release; osi_mutex_unlock(&hci_hal_env.adv_flow_lock); @@ -541,7 +544,7 @@ static void hci_hal_h4_hdl_rx_adv_rpt(pkt_linked_item_t *linked_pkt) BT_HDR* packet = (BT_HDR *)linked_pkt->data; stream = packet->data + packet->offset; - assert(host_recv_adv_packet(stream) == true); + assert(host_recv_adv_packet(stream, packet->len) == true); STREAM_TO_UINT8(type, stream); packet->offset++; @@ -586,7 +589,10 @@ static void host_send_pkt_available_cb(void) void bt_record_hci_data(uint8_t *data, uint16_t len) { #if (BT_HCI_LOG_INCLUDED == TRUE) - if ((data[0] == DATA_TYPE_EVENT) && (data[1] == HCI_BLE_EVENT) && ((data[3] == HCI_BLE_ADV_PKT_RPT_EVT) || (data[3] == HCI_BLE_DIRECT_ADV_EVT) + if (len < 2) { + return; + } + if ((len >= 4) && (data[0] == DATA_TYPE_EVENT) && (data[1] == HCI_BLE_EVENT) && ((data[3] == HCI_BLE_ADV_PKT_RPT_EVT) || (data[3] == HCI_BLE_DIRECT_ADV_EVT) #if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE) || (data[3] == HCI_BLE_ADV_DISCARD_REPORT_EVT) #endif // (BLE_ADV_REPORT_FLOW_CONTROL == TRUE) @@ -639,7 +645,7 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len) } #endif // #if (BLE_FEAT_ISO_EN == TRUE) - bool is_adv_rpt = host_recv_adv_packet(data); + bool is_adv_rpt = host_recv_adv_packet(data, len); if (!is_adv_rpt) { pkt_size = BT_HDR_SIZE + len; @@ -698,7 +704,7 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len) hci_upstream_data_post(OSI_THREAD_MAX_TIMEOUT); - BTTRC_DUMP_BUFFER("Recv Pkt", pkt->data, len); + BTTRC_DUMP_BUFFER("Recv Pkt", data, len); return 0; } diff --git a/components/bt/host/bluedroid/hci/hci_layer.c b/components/bt/host/bluedroid/hci/hci_layer.c index 2ed3172c254..4bf553d0ce6 100644 --- a/components/bt/host/bluedroid/hci/hci_layer.c +++ b/components/bt/host/bluedroid/hci/hci_layer.c @@ -117,7 +117,7 @@ int hci_start_up(void) hci_host_thread = osi_thread_create(HCI_HOST_TASK_NAME, HCI_HOST_TASK_STACK_SIZE, HCI_HOST_TASK_PRIO, HCI_HOST_TASK_PINNED_TO_CORE, HCI_HOST_TASK_WORKQUEUE_NUM, workqueue_len); if (hci_host_thread == NULL) { - return -2; + goto error; } osi_event_bind(hci_host_env.downstream_data_ready, hci_host_thread, HCI_DOWNSTREAM_DATA_QUEUE_IDX); @@ -135,13 +135,15 @@ error: void hci_shut_down(void) { hci_host_startup_flag = false; + + /* Close HAL and cleanup before freeing thread: hal->open() and osi_event_bind() + * stored references to hci_host_thread; they must not use it after osi_thread_free(). */ + if (hci_host_thread != NULL) { + hal->close(); + packet_fragmenter->cleanup(); + } hci_layer_deinit_env(); - packet_fragmenter->cleanup(); - - //low_power_manager->cleanup(); - hal->close(); - osi_thread_free(hci_host_thread); hci_host_thread = NULL; } @@ -197,7 +199,7 @@ static int hci_layer_init_env(void) HCI_TRACE_ERROR("%s unable to create command response timer.", __func__); return -1; } -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) btsnd_hcic_ble_sync_sem_init(); #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) @@ -223,9 +225,9 @@ static void hci_layer_deinit_env(void) osi_mutex_free(&cmd_wait_q->commands_pending_response_lock); osi_alarm_free(cmd_wait_q->command_response_timer); cmd_wait_q->command_response_timer = NULL; -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) btsnd_hcic_ble_sync_sem_deinit(); -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#endif // ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) } static void hci_downstream_data_handler(void *arg) @@ -443,7 +445,7 @@ static bool filter_incoming_event(BT_HDR *packet) { pkt_linked_item_t *wait_entry = NULL; hci_cmd_metadata_t *metadata = NULL; - uint8_t *stream = packet->data + packet->offset; + uint8_t *stream; uint8_t event_code; command_opcode_t opcode; @@ -451,6 +453,8 @@ static bool filter_incoming_event(BT_HDR *packet) return true; } + stream = packet->data + packet->offset; + if (packet->len < HCI_EVENT_PREAMBLE_SIZE) { HCI_TRACE_WARNING("dropping too short HCI event (len=%u)", packet->len); osi_free(packet); @@ -477,7 +481,7 @@ static bool filter_incoming_event(BT_HDR *packet) metadata = (hci_cmd_metadata_t *)(wait_entry->data); if (metadata->command_complete_cb) { metadata->command_complete_cb(packet, metadata->context); -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) BlE_SYNC *sync_info = btsnd_hcic_ble_get_sync_info(); if(!sync_info) { HCI_TRACE_WARNING("%s sync_info is NULL. opcode = 0x%x", __func__, opcode); @@ -487,7 +491,7 @@ static bool filter_incoming_event(BT_HDR *packet) sync_info->opcode = 0; } } -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#endif // #if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) } else if (metadata->flags_vnd & HCI_CMD_MSG_F_VND_FUTURE) { future_ready((future_t *)(metadata->complete_future), packet); } diff --git a/components/bt/host/bluedroid/hci/hci_packet_factory.c b/components/bt/host/bluedroid/hci/hci_packet_factory.c index 6a84f9ca29f..f710046d0e4 100644 --- a/components/bt/host/bluedroid/hci/hci_packet_factory.c +++ b/components/bt/host/bluedroid/hci/hci_packet_factory.c @@ -250,6 +250,8 @@ static BT_HDR *make_command_no_params(uint16_t opcode) static BT_HDR *make_command(uint16_t opcode, size_t parameter_size, uint8_t **stream_out) { BT_HDR *packet = HCI_GET_CMD_BUF(parameter_size); + assert(packet != NULL); + hci_cmd_metadata_t *metadata = HCI_GET_CMD_METAMSG(packet); metadata->opcode = opcode; diff --git a/components/bt/host/bluedroid/hci/include/hci/ble_hci_iso.h b/components/bt/host/bluedroid/hci/include/hci/ble_hci_iso.h index 9b289677962..4394363eadf 100644 --- a/components/bt/host/bluedroid/hci/include/hci/ble_hci_iso.h +++ b/components/bt/host/bluedroid/hci/include/hci/ble_hci_iso.h @@ -69,10 +69,6 @@ struct ble_hci_iso_conn { int ble_hci_set_iso_buf_sz(uint16_t pktlen, uint8_t max_pkts); -void ble_hci_get_iso_buf_size(uint16_t *pktlen, uint8_t *max_pkts); - -void ble_hci_add_iso_avail_pkts(uint16_t delta); - struct ble_hci_iso_conn *ble_hci_iso_conn_find(uint16_t conn_handle); int esp_ble_hci_iso_tx(uint16_t conn_handle, const uint8_t *sdu, uint16_t sdu_len, diff --git a/components/bt/host/bluedroid/hci/packet_fragmenter.c b/components/bt/host/bluedroid/hci/packet_fragmenter.c index ab10c34de62..26671bfe657 100644 --- a/components/bt/host/bluedroid/hci/packet_fragmenter.c +++ b/components/bt/host/bluedroid/hci/packet_fragmenter.c @@ -73,9 +73,10 @@ static void fragment_and_dispatch(BT_HDR *packet) uint16_t continuation_handle; uint16_t max_data_size, max_packet_size, remaining_length; uint16_t event = packet->event & MSG_EVT_MASK; - uint8_t *stream = packet->data + packet->offset; + uint8_t *stream; assert(packet != NULL); + stream = packet->data + packet->offset; // We only fragment ACL packets if (event != MSG_STACK_TO_HC_HCI_ACL) { diff --git a/components/bt/host/bluedroid/main/bte_init.c b/components/bt/host/bluedroid/main/bte_init.c index 0039af9ae4c..65b1cade6a4 100644 --- a/components/bt/host/bluedroid/main/bte_init.c +++ b/components/bt/host/bluedroid/main/bte_init.c @@ -471,9 +471,6 @@ bt_status_t BTE_InitStack(void) } memset((void *)bta_jv_cb_ptr, 0, sizeof(tBTA_JV_CB)); #endif //JV -#if BTA_HS_INCLUDED == TRUE - memset((void *)bta_hs_cb_ptr, 0, sizeof(tBTA_HS_CB)); -#endif #if BTA_SDP_INCLUDED == TRUE if ((bta_sdp_cb_ptr = (tBTA_SDP_CB *)osi_malloc(sizeof(tBTA_SDP_CB))) == NULL) { goto error_exit; @@ -515,9 +512,6 @@ bt_status_t BTE_InitStack(void) } memset((void *)bta_hd_cb_ptr, 0, sizeof(tBTA_HD_CB)); #endif -#if BTA_HL_INCLUDED==TRUE - memset((void *)bta_hl_cb_ptr, 0, sizeof(tBTA_HL_CB)); -#endif #if GATTC_INCLUDED==TRUE if ((bta_gattc_cb_ptr = (tBTA_GATTC_CB *)osi_malloc(sizeof(tBTA_GATTC_CB))) == NULL) { goto error_exit; diff --git a/components/bt/host/bluedroid/main/bte_main.c b/components/bt/host/bluedroid/main/bte_main.c index 73cbafc644d..d50544ced4f 100644 --- a/components/bt/host/bluedroid/main/bte_main.c +++ b/components/bt/host/bluedroid/main/bte_main.c @@ -86,7 +86,10 @@ int bte_main_boot_entry(bluedroid_init_done_cb_t cb) bluedroid_init_done_cb = cb; - osi_init(); + if (osi_init() != 0) { + APPL_TRACE_ERROR("%s failed to initialize OS layer.\n", __func__); + return -1; + } //Enable HCI bte_main_enable(); @@ -235,6 +238,11 @@ void bte_main_lpm_wake_bt_device(void) ******************************************************************************/ void bte_main_hci_send (BT_HDR *p_msg, UINT16 event) { + if (!p_msg) { + APPL_TRACE_ERROR("%s null message\n", __func__); + return; + } + UINT16 sub_event = event & BT_SUB_EVT_MASK; /* local controller ID */ p_msg->event = event; diff --git a/components/bt/host/bluedroid/stack/btm/btm_acl.c b/components/bt/host/bluedroid/stack/btm/btm_acl.c index 9949c5585ea..5b7b2618680 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_acl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_acl.c @@ -49,6 +49,7 @@ #include "stack/hcidefs.h" //#include "bt_utils.h" #include "osi/list.h" +#include "bta_dm_gap.h" static void btm_read_remote_features (UINT16 handle); static void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number); @@ -362,124 +363,131 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L } else { p = (tACL_CONN *)osi_malloc(sizeof(tACL_CONN)); - if (p && list_append(btm_cb.p_acl_db_list, p)) { - memset(p, 0, sizeof(tACL_CONN)); - p->in_use = TRUE; - p->hci_handle = hci_handle; - p->link_role = link_role; - p->link_up_issued = FALSE; - memcpy (p->remote_addr, bda, BD_ADDR_LEN); - /* Set the default version of the peer device to version4.0 before exchange the version with it. - If the peer device act as a master and don't exchange the version with us, then it can only use the - legacy connect instead of secure connection in the pairing step. */ - p->lmp_version = HCI_PROTO_VERSION_4_0; + if (p == NULL) { + BTM_TRACE_ERROR("btm_acl_created: osi_malloc failed for tACL_CONN\n"); + return; + } + if (!list_append(btm_cb.p_acl_db_list, p)) { + BTM_TRACE_ERROR("btm_acl_created: list_append failed\n"); + osi_free(p); + return; + } + memset(p, 0, sizeof(tACL_CONN)); + p->in_use = TRUE; + p->hci_handle = hci_handle; + p->link_role = link_role; + p->link_up_issued = FALSE; + memcpy (p->remote_addr, bda, BD_ADDR_LEN); + /* Set the default version of the peer device to version4.0 before exchange the version with it. + If the peer device act as a master and don't exchange the version with us, then it can only use the + legacy connect instead of secure connection in the pairing step. */ + p->lmp_version = HCI_PROTO_VERSION_4_0; #if BLE_INCLUDED == TRUE - p->transport = transport; + p->transport = transport; #if BLE_PRIVACY_SPT == TRUE - if (transport == BT_TRANSPORT_LE) { - btm_ble_refresh_local_resolvable_private_addr(bda, - btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr); - } + if (transport == BT_TRANSPORT_LE) { + btm_ble_refresh_local_resolvable_private_addr(bda, + btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr); + } #else - p->conn_addr_type = BLE_ADDR_PUBLIC; - memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN); - BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n", - p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]); + p->conn_addr_type = BLE_ADDR_PUBLIC; + memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN); + BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n", + p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]); #endif #endif #if (CLASSIC_BT_INCLUDED == TRUE) - p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE; + p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE; - p->p_pm_mode_db = btm_pm_sm_alloc(); + p->p_pm_mode_db = btm_pm_sm_alloc(); #if BTM_PM_DEBUG == TRUE - BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state); + BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state); #endif // BTM_PM_DEBUG #endif // (CLASSIC_BT_INCLUDED == TRUE) #if (CLASSIC_BT_INCLUDED == TRUE) - btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE); + btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE); #endif - if (dc) { - memcpy (p->remote_dc, dc, DEV_CLASS_LEN); - } + if (dc) { + memcpy (p->remote_dc, dc, DEV_CLASS_LEN); + } - if (bdn) { - memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN); - } + if (bdn) { + memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN); + } - /* if BR/EDR do something more */ - if (transport == BT_TRANSPORT_BR_EDR) { - btsnd_hcic_read_rmt_clk_offset (p->hci_handle); - btsnd_hcic_rmt_ver_req (p->hci_handle); - } - p_dev_rec = btm_find_dev_by_handle (hci_handle); + /* if BR/EDR do something more */ + if (transport == BT_TRANSPORT_BR_EDR) { + btsnd_hcic_read_rmt_clk_offset (p->hci_handle); + btsnd_hcic_rmt_ver_req (p->hci_handle); + } + p_dev_rec = btm_find_dev_by_handle (hci_handle); #if (BLE_INCLUDED == TRUE) - if (p_dev_rec ) { - BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type); - } + if (p_dev_rec ) { + BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type); + } #endif - if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) { - if (!p_dev_rec->remote_secure_connection_previous_state) { - /* If remote features already known, copy them and continue connection setup */ - if ((p_dev_rec->num_read_pages) && - (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) { - memcpy (p->peer_lmp_features, p_dev_rec->features, - (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages)); - p->num_read_pages = p_dev_rec->num_read_pages; + if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) { + if (!p_dev_rec->remote_secure_connection_previous_state) { + /* If remote features already known, copy them and continue connection setup */ + if ((p_dev_rec->num_read_pages) && + (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) { + memcpy (p->peer_lmp_features, p_dev_rec->features, + (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages)); + p->num_read_pages = p_dev_rec->num_read_pages; #if (CLASSIC_BT_INCLUDED == TRUE) - const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND); + const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND); #endif ///CLASSIC_BT_INCLUDED == TRUE - /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */ + /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */ #if (SMP_INCLUDED == TRUE) - btm_sec_set_peer_sec_caps(p, p_dev_rec); + btm_sec_set_peer_sec_caps(p, p_dev_rec); #endif ///SMP_INCLUDED == TRUE #if (CLASSIC_BT_INCLUDED == TRUE) - BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend); - if (req_pend) { - /* Request for remaining Security Features (if any) */ - l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr); - } -#endif ///CLASSIC_BT_INCLUDED == TRUE - btm_establish_continue (p); - return; + BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend); + if (req_pend) { + /* Request for remaining Security Features (if any) */ + l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr); } - } else { - /* If remote features indicated secure connection (SC) mode, check the remote features again*/ - /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/ - btm_read_remote_features (p->hci_handle); +#endif ///CLASSIC_BT_INCLUDED == TRUE + btm_establish_continue (p); + return; } - } - -#if (BLE_INCLUDED == TRUE) - /* If here, features are not known yet */ - if (p_dev_rec && transport == BT_TRANSPORT_LE) { -#if BLE_PRIVACY_SPT == TRUE - btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr, - &p->active_remote_addr_type); -#endif - - if (link_role == HCI_ROLE_MASTER) { - btsnd_hcic_ble_read_remote_feat(p->hci_handle); - } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array) - && link_role == HCI_ROLE_SLAVE) { - btsnd_hcic_rmt_ver_req (p->hci_handle); - } else { - btm_establish_continue(p); - } - } else -#endif - { + } else { + /* If remote features indicated secure connection (SC) mode, check the remote features again*/ + /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/ btm_read_remote_features (p->hci_handle); } - - /* read page 1 - on rmt feature event for buffer reasons */ - return; } + +#if (BLE_INCLUDED == TRUE) + /* If here, features are not known yet */ + if (p_dev_rec && transport == BT_TRANSPORT_LE) { +#if BLE_PRIVACY_SPT == TRUE + btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr, + &p->active_remote_addr_type); +#endif + + if (link_role == HCI_ROLE_MASTER) { + btsnd_hcic_ble_read_remote_feat(p->hci_handle); + } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array) + && link_role == HCI_ROLE_SLAVE) { + btsnd_hcic_rmt_ver_req (p->hci_handle); + } else { + btm_establish_continue(p); + } + } else +#endif + { + btm_read_remote_features (p->hci_handle); + } + + /* read page 1 - on rmt feature event for buffer reasons */ + return; } } @@ -589,11 +597,9 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport) #if (CLASSIC_BT_INCLUDED == TRUE) list_remove(btm_cb.p_pm_mode_db_list, p->p_pm_mode_db); #endif // #if (CLASSIC_BT_INCLUDED == TRUE) - /* Clear the ACL connection data */ - memset(p, 0, sizeof(tACL_CONN)); - if (list_remove(btm_cb.p_acl_db_list, p)) { - p = NULL; - } + /* Remove and free the ACL connection data */ + list_remove(btm_cb.p_acl_db_list, p); + p = NULL; } } @@ -2270,10 +2276,12 @@ void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types) ** Returns BTM_CMD_STARTED if successfully initiated or error code ** *******************************************************************************/ -tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb) +tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda) { tACL_CONN *p; tBTM_BLE_CH_MAP_RESULTS result; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + UINT8 status; BTM_TRACE_DEBUG("BTM_ReadChannelMap: RemBdAddr: %02x%02x%02x%02x%02x%02x\n", remote_bda[0], remote_bda[1], remote_bda[2], @@ -2281,29 +2289,33 @@ tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb) memset(result.channel_map, 0, sizeof(result.channel_map)); // Clear channel map data /* If someone already waiting for the channel map, do not allow another */ - if (btm_cb.devcb.p_ble_ch_map_cmpl_cb) { + if (btm_cb.devcb.is_ch_map_cb) { result.status = BTM_BUSY; - (*p_cb)(&result); - return BTM_BUSY; + status = BTM_BUSY; + goto _ch_map_err; } p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE); if (p != NULL) { - btm_cb.devcb.p_ble_ch_map_cmpl_cb = p_cb; - if (!btsnd_hcic_ble_read_chnl_map(p->hci_handle)) { - btm_cb.devcb.p_ble_ch_map_cmpl_cb = NULL; + btm_cb.devcb.is_ch_map_cb = false; result.status = BTM_NO_RESOURCES; - (*p_cb)(&result); - return BTM_NO_RESOURCES; + status = BTM_NO_RESOURCES; + goto _ch_map_err; } else { + btm_cb.devcb.is_ch_map_cb = true; return BTM_CMD_STARTED; } } - + status = BTM_UNKNOWN_ADDR; /* If here, no BD Addr found */ result.status = BTM_UNKNOWN_ADDR; - (*p_cb)(&result); - return BTM_UNKNOWN_ADDR; + +_ch_map_err: + memset(&cb_params, 0, sizeof(cb_params)); + // `ch_map_read` is same as `results` + memcpy(&cb_params.ch_map_results, &result, sizeof(tBTM_BLE_CH_MAP_RESULTS)); + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_READ_CHANNEL_MAP_EVT, &cb_params); + return status; } void BTM_BleGetWhiteListSize(uint16_t *length) @@ -2344,17 +2356,16 @@ void BTM_BleGetPeriodicAdvListSize(uint8_t *size) *******************************************************************************/ void btm_read_channel_map_complete(UINT8 *p) { - tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_ble_ch_map_cmpl_cb; tBTM_BLE_CH_MAP_RESULTS results; UINT16 handle; tACL_CONN *p_acl_cb = NULL; BTM_TRACE_DEBUG("btm_read_channel_map_complete\n"); - /* Reset the callback pointer to prevent duplicate calls */ - btm_cb.devcb.p_ble_ch_map_cmpl_cb = NULL; - - if (p_cb) { + if (btm_cb.devcb.is_ch_map_cb) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; + /* Reset the callback pointer to prevent duplicate calls */ + btm_cb.devcb.is_ch_map_cb = false; /* Extract HCI status from the response */ STREAM_TO_UINT8(results.hci_status, p); @@ -2381,7 +2392,10 @@ void btm_read_channel_map_complete(UINT8 *p) } /* Invoke the registered callback with the results */ - (*p_cb)(&results); + memset(&cb_params, 0, sizeof(cb_params)); + // `ch_map_read` is same as `results` + memcpy(&cb_params.ch_map_results, &results, sizeof(tBTM_BLE_CH_MAP_RESULTS)); + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_READ_CHANNEL_MAP_EVT, &cb_params); } } #endif // #if BLE_INCLUDED == TRUE @@ -2399,7 +2413,7 @@ void btm_read_channel_map_complete(UINT8 *p) void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len) { tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_rssi_cmpl_cb; - tBTM_RSSI_RESULTS results; + tBTM_RSSI_RESULTS results = {0}; UINT16 handle; tACL_CONN *p_acl_cb = NULL; BTM_TRACE_DEBUG ("btm_read_rssi_complete\n"); @@ -2431,10 +2445,12 @@ void btm_read_rssi_complete (UINT8 *p, UINT16 evt_len) results.rssi, results.hci_status); /* Search through the list of active channels for the correct BD Addr */ - p_acl_cb = btm_handle_to_acl(handle); - if (p_acl_cb) { + p_acl_cb = btm_handle_to_acl(handle); + if (p_acl_cb) { memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN); - } + } else { + results.status = BTM_UNKNOWN_ADDR; + } } else { results.status = BTM_ERR_PROCESSING; } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble.c b/components/bt/host/bluedroid/stack/btm/btm_ble.c index 60601893da8..71dcdc0768b 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble.c @@ -407,8 +407,9 @@ void BTM_BlePasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey) BTM_TRACE_ERROR("Passkey reply to Unknown device"); return; } - - p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; + if (res_smp == SMP_SUCCESS) { + p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; + } BTM_TRACE_DEBUG ("BTM_BlePasskeyReply"); SMP_PasskeyReply(bd_addr, res_smp, passkey); #endif @@ -487,8 +488,9 @@ void BTM_BleOobDataReply(BD_ADDR bd_addr, UINT8 res, UINT8 len, UINT8 *p_data) BTM_TRACE_ERROR("BTM_BleOobDataReply() to Unknown device"); return; } - - p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; + if (res_smp == SMP_SUCCESS) { + p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; + } SMP_OobDataReply(bd_addr, res_smp, len, p_data); #endif } @@ -902,7 +904,7 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length) } else if (tx_pdu_length < BTM_BLE_DATA_SIZE_MIN) { tx_pdu_length = BTM_BLE_DATA_SIZE_MIN; } - + p_acl->data_len_updating = true; /* always set the TxTime to be max, as controller does not care for now */ btsnd_hcic_ble_set_data_length(p_acl->hci_handle, tx_pdu_length, BTM_BLE_DATA_TX_TIME_MAX); @@ -1431,6 +1433,7 @@ void btm_ble_link_sec_check(BD_ADDR bd_addr, tBTM_LE_AUTH_REQ auth_req, tBTM_BLE if (p_dev_rec == NULL) { BTM_TRACE_ERROR ("btm_ble_link_sec_check received for unknown device"); + *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_NONE; return; } @@ -2170,9 +2173,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data) case SMP_OOB_REQ_EVT: case SMP_NC_REQ_EVT: case SMP_SC_OOB_REQ_EVT: - /* fall through */ - p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED; - + /* fall through */ case SMP_SEC_REQUEST_EVT: if (event == SMP_SEC_REQUEST_EVT && btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) { BTM_TRACE_DEBUG("%s: Ignoring SMP Security request", __func__); diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c index 22bb764988c..40498baddc3 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c @@ -16,12 +16,14 @@ tBTM_BLE_EXTENDED_CB extend_adv_cb; tBTM_BLE_5_HCI_CBACK ble_5_hci_cb; -#define INVALID_VALUE 0XFF +#define INVALID_VALUE_8BIT 0XFF +#define INVALID_VALUE_16BIT 0XFFFF +#define INVALID_VALUE_32BIT 0XFFFFFFFF extern BOOLEAN BTM_GetLocalResolvablePrivateAddr(BD_ADDR bda); extern void BTM_UpdateAddrInfor(uint8_t addr_type, BD_ADDR bda); extern void BTM_BleSetStaticAddr(BD_ADDR rand_addr); -extern uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb); +extern uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type); #if (BLE_50_EXTEND_ADV_EN == TRUE) static tBTM_STATUS btm_ble_ext_adv_params_validate(tBTM_BLE_GAP_EXT_ADV_PARAMS *params); static tBTM_STATUS btm_ble_ext_adv_set_data_validate(UINT8 instance, UINT16 len, UINT8 *data); @@ -54,158 +56,6 @@ static tBTM_BLE_SYNC_RETRY_CB sync_retry_cb = {0}; extern void btm_ble_inter_set(bool extble_inter); -#if !UC_BT_STACK_NO_LOG -static const char *btm_ble_hci_status_to_str(tHCI_STATUS status) -{ - switch(status) { - case HCI_SUCCESS: - return "HCI_SUCCESS"; - case HCI_ERR_ILLEGAL_COMMAND: - return "HCI_ERR_ILLEGAL_COMMAND"; - case HCI_ERR_NO_CONNECTION: - return "HCI_ERR_NO_CONNECTION"; - case HCI_ERR_HW_FAILURE: - return "HCI_ERR_HW_FAILURE"; - case HCI_ERR_PAGE_TIMEOUT: - return "HCI_ERR_PAGE_TIMEOUT"; - case HCI_ERR_AUTH_FAILURE: - return "HCI_ERR_AUTH_FAILURE"; - case HCI_ERR_KEY_MISSING: - return "HCI_ERR_KEY_MISSING"; - case HCI_ERR_MEMORY_FULL: - return "HCI_ERR_MEMORY_FULL"; - case HCI_ERR_CONNECTION_TOUT: - return "HCI_ERR_CONNECTION_TOUT"; - case HCI_ERR_MAX_NUM_OF_CONNECTIONS: - return "HCI_ERR_MAX_NUM_OF_CONNECTIONS"; - case HCI_ERR_MAX_NUM_OF_SCOS: - return "HCI_ERR_MAX_NUM_OF_SCOS"; - case HCI_ERR_CONNECTION_EXISTS: - return "HCI_ERR_CONNECTION_EXISTS"; - case HCI_ERR_COMMAND_DISALLOWED: - return "HCI_ERR_COMMAND_DISALLOWED"; - case HCI_ERR_HOST_REJECT_RESOURCES: - return "HCI_ERR_HOST_REJECT_RESOURCES"; - case HCI_ERR_HOST_REJECT_SECURITY: - return "HCI_ERR_HOST_REJECT_SECURITY"; - case HCI_ERR_HOST_REJECT_DEVICE: - return "HCI_ERR_HOST_REJECT_DEVICE"; - case HCI_ERR_HOST_TIMEOUT: - return "HCI_ERR_HOST_TIMEOUT"; - case HCI_ERR_UNSUPPORTED_VALUE: - return "HCI_ERR_UNSUPPORTED_VALUE"; - case HCI_ERR_ILLEGAL_PARAMETER_FMT: - return "HCI_ERR_ILLEGAL_PARAMETER_FMT"; - case HCI_ERR_PEER_USER: - return "HCI_ERR_PEER_USER"; - case HCI_ERR_PEER_LOW_RESOURCES: - return "HCI_ERR_PEER_LOW_RESOURCES"; - case HCI_ERR_PEER_POWER_OFF: - return "HCI_ERR_PEER_POWER_OFF"; - case HCI_ERR_CONN_CAUSE_LOCAL_HOST: - return "HCI_ERR_CONN_CAUSE_LOCAL_HOST"; - case HCI_ERR_REPEATED_ATTEMPTS: - return "HCI_ERR_REPEATED_ATTEMPTS"; - case HCI_ERR_PAIRING_NOT_ALLOWED: - return "HCI_ERR_PAIRING_NOT_ALLOWED"; - case HCI_ERR_UNKNOWN_LMP_PDU: - return "HCI_ERR_UNKNOWN_LMP_PDU"; - case HCI_ERR_UNSUPPORTED_REM_FEATURE: - return "HCI_ERR_UNSUPPORTED_REM_FEATURE"; - case HCI_ERR_SCO_OFFSET_REJECTED: - return "HCI_ERR_SCO_OFFSET_REJECTED"; - case HCI_ERR_SCO_INTERVAL_REJECTED: - return "HCI_ERR_SCO_INTERVAL_REJECTED"; - case HCI_ERR_SCO_AIR_MODE: - return "HCI_ERR_SCO_AIR_MODE"; - case HCI_ERR_INVALID_LMP_PARAM: - return "HCI_ERR_INVALID_LMP_PARAM"; - case HCI_ERR_UNSPECIFIED: - return "HCI_ERR_UNSPECIFIED"; - case HCI_ERR_UNSUPPORTED_LMP_PARAMETERS: - return "HCI_ERR_UNSUPPORTED_LMP_PARAMETERS"; - case HCI_ERR_ROLE_CHANGE_NOT_ALLOWED: - return "HCI_ERR_ROLE_CHANGE_NOT_ALLOWED"; - case HCI_ERR_LMP_RESPONSE_TIMEOUT: - return "HCI_ERR_LMP_RESPONSE_TIMEOUT"; - case HCI_ERR_LMP_ERR_TRANS_COLLISION: - return "HCI_ERR_LMP_ERR_TRANS_COLLISION"; - case HCI_ERR_LMP_PDU_NOT_ALLOWED: - return "HCI_ERR_LMP_PDU_NOT_ALLOWED"; - case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE: - return "HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE"; - case HCI_ERR_UNIT_KEY_USED: - return "HCI_ERR_UNIT_KEY_USED"; - case HCI_ERR_QOS_NOT_SUPPORTED: - return "HCI_ERR_QOS_NOT_SUPPORTED"; - case HCI_ERR_INSTANT_PASSED: - return "HCI_ERR_INSTANT_PASSED"; - case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED: - return "HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED"; - case HCI_ERR_DIFF_TRANSACTION_COLLISION: - return "HCI_ERR_DIFF_TRANSACTION_COLLISION"; - case HCI_ERR_UNDEFINED_0x2B: - return "HCI_ERR_UNDEFINED_0x2B"; - case HCI_ERR_QOS_UNACCEPTABLE_PARAM: - return "HCI_ERR_QOS_UNACCEPTABLE_PARAM"; - case HCI_ERR_QOS_REJECTED: - return "HCI_ERR_QOS_REJECTED"; - case HCI_ERR_CHAN_CLASSIF_NOT_SUPPORTED: - return "HCI_ERR_CHAN_CLASSIF_NOT_SUPPORTED"; - case HCI_ERR_INSUFFCIENT_SECURITY: - return "HCI_ERR_INSUFFCIENT_SECURITY"; - case HCI_ERR_PARAM_OUT_OF_RANGE: - return "HCI_ERR_PARAM_OUT_OF_RANGE"; - case HCI_ERR_UNDEFINED_0x31: - return "HCI_ERR_UNDEFINED_0x31"; - case HCI_ERR_ROLE_SWITCH_PENDING: - return "HCI_ERR_ROLE_SWITCH_PENDING"; - case HCI_ERR_UNDEFINED_0x33: - return "HCI_ERR_UNDEFINED_0x33"; - case HCI_ERR_RESERVED_SLOT_VIOLATION: - return "HCI_ERR_RESERVED_SLOT_VIOLATION"; - case HCI_ERR_ROLE_SWITCH_FAILED: - return "HCI_ERR_ROLE_SWITCH_FAILED"; - case HCI_ERR_INQ_RSP_DATA_TOO_LARGE: - return "HCI_ERR_INQ_RSP_DATA_TOO_LARGE"; - case HCI_ERR_SIMPLE_PAIRING_NOT_SUPPORTED: - return "HCI_ERR_SIMPLE_PAIRING_NOT_SUPPORTED"; - case HCI_ERR_HOST_BUSY_PAIRING: - return "HCI_ERR_HOST_BUSY_PAIRING"; - case HCI_ERR_REJ_NO_SUITABLE_CHANNEL: - return "HCI_ERR_REJ_NO_SUITABLE_CHANNEL"; - case HCI_ERR_CONTROLLER_BUSY: - return "HCI_ERR_CONTROLLER_BUSY"; - case HCI_ERR_UNACCEPT_CONN_INTERVAL: - return "HCI_ERR_UNACCEPT_CONN_INTERVAL"; - case HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT: - return "HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT"; - case HCI_ERR_CONN_TOUT_DUE_TO_MIC_FAILURE: - return "HCI_ERR_CONN_TOUT_DUE_TO_MIC_FAILURE"; - case HCI_ERR_CONN_FAILED_ESTABLISHMENT: - return "HCI_ERR_CONN_FAILED_ESTABLISHMENT"; - case HCI_ERR_MAC_CONNECTION_FAILED: - return "HCI_ERR_MAC_CONNECTION_FAILED"; - case HCI_ERR_LT_ADDR_ALREADY_IN_USE: - return "HCI_ERR_LT_ADDR_ALREADY_IN_USE"; - case HCI_ERR_LT_ADDR_NOT_ALLOCATED: - return "HCI_ERR_LT_ADDR_NOT_ALLOCATED"; - case HCI_ERR_CLB_NOT_ENABLED: - return "HCI_ERR_CLB_NOT_ENABLED"; - case HCI_ERR_MAX_ERR: - return "HCI_ERR_MAX_ERR"; - case HCI_ERR_ESP_VENDOR_FAIL: - return "HCI_ERR_ESP_VENDOR_FAIL"; - case HCI_HINT_TO_RECREATE_AMP_PHYS_LINK: - return "HCI_HINT_TO_RECREATE_AMP_PHYS_LINK"; - default: - return "Invalid HCI status code."; - } - - return NULL; -} -#endif /* !UC_BT_STACK_NO_LOG */ - void btm_ble_extendadvcb_init(void) { memset(&extend_adv_cb, 0, sizeof(tBTM_BLE_EXTENDED_CB)); @@ -245,9 +95,7 @@ tBTM_STATUS BTM_BleReadPhy(BD_ADDR bd_addr, UINT8 *tx_phy, UINT8 *rx_phy) cb_params.read_phy.status = BTM_ILLEGAL_VALUE; memcpy(cb_params.read_phy.addr, bd_addr, BD_ADDR_LEN); - if (ble_5_hci_cb) { - ble_5_hci_cb(BTM_BLE_5_GAP_READ_PHY_COMPLETE_EVT, &cb_params); - } + BTM_ExtBleCallbackTrigger(BTM_BLE_5_GAP_READ_PHY_COMPLETE_EVT, &cb_params); BTM_TRACE_ERROR("%s, invalid parameters", __func__); return BTM_ILLEGAL_VALUE; } @@ -265,8 +113,8 @@ tBTM_STATUS BTM_BleSetPreferDefaultPhy(UINT8 tx_phy_mask, UINT8 rx_phy_mask) tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0}; if ((err = btsnd_hcic_ble_set_prefered_default_phy(all_phys, tx_phy_mask, rx_phy_mask)) != HCI_SUCCESS) { - BTM_TRACE_ERROR("%s, fail to send the hci command, the error code = %s(0x%x)", - __func__, btm_ble_hci_status_to_str(err), err); + BTM_TRACE_ERROR("%s, fail to send the hci command, the error code = 0x%x", + __func__, err); status = BTM_HCI_ERROR | err; } @@ -286,9 +134,7 @@ tBTM_STATUS BTM_BleSetPreferPhy(BD_ADDR bd_addr, UINT8 all_phys, UINT8 tx_phy_ma if (!p_lcb) { cb_params.status = BTM_ILLEGAL_VALUE; - if (ble_5_hci_cb) { - ble_5_hci_cb(BTM_BLE_5_GAP_SET_PREFERED_PHY_COMPLETE_EVT, &cb_params); - } + BTM_ExtBleCallbackTrigger(BTM_BLE_5_GAP_SET_PREFERED_PHY_COMPLETE_EVT, &cb_params); BTM_TRACE_ERROR("%s, invalid parameters", __func__); return BTM_ILLEGAL_VALUE; } @@ -347,8 +193,8 @@ tBTM_STATUS BTM_BleSetExtendedAdvRandaddr(UINT8 instance, BD_ADDR rand_addr) // set random address if((err = btsnd_hcic_ble_set_extend_rand_address(instance, rand_addr)) != HCI_SUCCESS) { - BTM_TRACE_ERROR("%s, fail to send the hci command, the error code = %s(0x%x)", - __func__, btm_ble_hci_status_to_str(err), err); + BTM_TRACE_ERROR("%s, fail to send the hci command, the error code = 0x%x", + __func__, err); status = BTM_HCI_ERROR | err; } else { // set random address success, update address info @@ -382,6 +228,7 @@ tBTM_STATUS BTM_BleSetExtendedAdvParams(UINT8 instance, tBTM_BLE_GAP_EXT_ADV_PAR if ((status = btm_ble_ext_adv_params_validate(params)) != BTM_SUCCESS) { BTM_TRACE_ERROR("%s, invalid extend adv params.", __func__); + goto end; } if (params->type & BTM_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE) { @@ -529,13 +376,21 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_ UINT8 *max_events = NULL; // when enable = true, ext_adv = NULL or num = 0, goto end - if ((!ext_adv || num == 0) && enable) { + if (num > MAX_BLE_ADV_INSTANCE || (num > 0 && !ext_adv) || (enable && num == 0)) { status = BTM_ILLEGAL_VALUE; BTM_TRACE_ERROR("%s invalid parameters", __func__); goto end; } if (num != 0 && ext_adv != NULL) { + for (int i = 0; i < num; i++) { + if (ext_adv[i].instance >= MAX_BLE_ADV_INSTANCE) { + status = BTM_ILLEGAL_VALUE; + BTM_TRACE_ERROR("%s instance ID %d out of range", __func__, ext_adv[i].instance); + goto end; + } + } + instance = osi_malloc(num); duration = osi_malloc(num*sizeof(UINT16)); max_events = osi_malloc(num*sizeof(UINT8)); @@ -557,10 +412,6 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_ BTM_TRACE_ERROR("LE EA En=%d: cmd err=0x%x", enable, err); status = BTM_HCI_ERROR | err; } - - osi_free(instance); - osi_free(duration); - osi_free(max_events); } else { // enable = false, num == 0 or ext_adv = NULL @@ -574,6 +425,15 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_ end: + if (instance) { + osi_free(instance); + } + if (duration) { + osi_free(duration); + } + if (max_events) { + osi_free(max_events); + } if (!enable && status == BTM_SUCCESS) { // disable all ext adv @@ -583,20 +443,23 @@ end: { adv_record[i].invalid = false; adv_record[i].enabled = false; - adv_record[i].instance = INVALID_VALUE; - adv_record[i].duration = INVALID_VALUE; - adv_record[i].max_events = INVALID_VALUE; + adv_record[i].instance = INVALID_VALUE_8BIT; + adv_record[i].duration = INVALID_VALUE_32BIT; + adv_record[i].max_events = INVALID_VALUE_32BIT; adv_record[i].retry_count = 0; } } else { for (uint8_t i = 0; i < num; i++) { uint8_t index = ext_adv[i].instance; + if (index >= MAX_BLE_ADV_INSTANCE) { + continue; + } adv_record[index].invalid = false; adv_record[index].enabled = false; - adv_record[index].instance = INVALID_VALUE; - adv_record[index].duration = INVALID_VALUE; - adv_record[index].max_events = INVALID_VALUE; + adv_record[index].instance = INVALID_VALUE_8BIT; + adv_record[index].duration = INVALID_VALUE_32BIT; + adv_record[index].max_events = INVALID_VALUE_32BIT; adv_record[index].retry_count = 0; } } @@ -606,6 +469,9 @@ end: for (uint8_t i = 0; i < num; i++) { uint8_t index = ext_adv[i].instance; + if (index >= MAX_BLE_ADV_INSTANCE) { + continue; + } adv_record[index].invalid = true; adv_record[index].enabled = true; adv_record[index].instance = ext_adv[i].instance; @@ -616,9 +482,12 @@ end: } cb_params.adv_start.status = status; + num = (num > MAX_BLE_ADV_INSTANCE) ? MAX_BLE_ADV_INSTANCE : num; cb_params.adv_start.instance_num = num; - for (uint8_t i = 0; i < num; i++) { - cb_params.adv_start.instance[i] = ext_adv[i].instance; + if (ext_adv) { + for (uint8_t i = 0; i < num; i++) { + cb_params.adv_start.instance[i] = ext_adv[i].instance; + } } BTM_ExtBleCallbackTrigger(enable ? BTM_BLE_5_GAP_EXT_ADV_START_COMPLETE_EVT : BTM_BLE_5_GAP_EXT_ADV_STOP_COMPLETE_EVT, &cb_params); @@ -626,10 +495,10 @@ end: return status; } -tBTM_STATUS BTM_BleStartExtAdvRestart(uint8_t con_handle) +tBTM_STATUS BTM_BleStartExtAdvRestart(uint16_t con_handle) { tBTM_BLE_EXT_ADV ext_adv; - uint8_t index = INVALID_VALUE; + uint8_t index = INVALID_VALUE_8BIT; for (uint8_t i = 0; i < MAX_BLE_ADV_INSTANCE; i++) { if(adv_record[i].ter_con_handle == con_handle) { @@ -798,7 +667,7 @@ tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data } } - if ((err = btsnd_hcic_ble_set_periodic_adv_data(instance, operation, send_data_len, &data[data_offset])) != HCI_SUCCESS) { + if ((err = btsnd_hcic_ble_set_periodic_adv_data(instance, operation, send_data_len, (data == NULL)? NULL : &data[data_offset])) != HCI_SUCCESS) { BTM_TRACE_ERROR("LE PA SetData: cmd err=0x%x", err); status = BTM_HCI_ERROR | err; break; @@ -900,7 +769,7 @@ tBTM_STATUS BTM_BlePeriodicAdvCreateSync(tBTM_BLE_Periodic_Sync_Params *params) sync_retry_cb.in_use = true; #endif // #if (BLE_FEAT_CREATE_SYNC_RETRY_MAX > 0) if (!btsnd_hcic_ble_periodic_adv_create_sync(option, params->sid, params->addr_type, - params->addr, params->sync_timeout, params->sync_cte_type)) { + params->addr, params->skip, params->sync_timeout, params->sync_cte_type)) { BTM_TRACE_ERROR("LE PA CreateSync cmd failed"); status = BTM_ILLEGAL_VALUE; #if (BLE_FEAT_CREATE_SYNC_RETRY_MAX > 0) @@ -1097,7 +966,7 @@ tBTM_STATUS BTM_BleSetExtendedScanParams(tBTM_BLE_EXT_SCAN_PARAMS *params) phy_count++; } - if (BTM_BleUpdateOwnType(¶ms->own_addr_type, NULL) != 0 ) { + if (BTM_BleUpdateOwnType(¶ms->own_addr_type) != 0 ) { status = BTM_ILLEGAL_VALUE; BTM_TRACE_ERROR("LE UpdateOwnType err"); goto end; @@ -1310,7 +1179,7 @@ void btm_ble_adv_set_terminated_evt(tBTM_BLE_ADV_TERMINAT *params) if(params->status == 0x00) { adv_record[params->adv_handle].ter_con_handle = params->conn_handle; } else { - adv_record[params->adv_handle].ter_con_handle = INVALID_VALUE; + adv_record[params->adv_handle].ter_con_handle = INVALID_VALUE_16BIT; adv_record[params->adv_handle].invalid = false; } adv_record[params->adv_handle].enabled = false; @@ -1573,6 +1442,7 @@ void btm_ble_periodic_adv_sync_establish_evt(tBTM_BLE_PERIOD_ADV_SYNC_ESTAB *par sync_retry_cb.params.sid, sync_retry_cb.params.addr_type, sync_retry_cb.params.addr, + sync_retry_cb.params.skip, sync_retry_cb.params.sync_timeout, sync_retry_cb.params.sync_cte_type)) { /* Retry command sent successfully, wait for next event */ @@ -2110,6 +1980,7 @@ void btm_ble_cs_security_enable_cmd_status(UINT8 status) tBTM_BLE_CS_SEC_ENABLE_CMPL_EVT cs_security_enable = {0}; if (status != HCI_SUCCESS) { cs_security_enable.status = (status | BTM_HCI_ERROR); + cs_security_enable.conn_handle = 0xFFFF; // Invalid handle BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_SECURITY_ENABLE_CMPL_EVT, (tBTM_BLE_5_GAP_CB_PARAMS *)&cs_security_enable); } } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c b/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c index cb29e93c4ca..5bb4a80e7e5 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_addr.c @@ -34,6 +34,7 @@ #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE) #include "btm_ble_int.h" #include "stack/smp_api.h" +#include "bta_dm_gap.h" /******************************************************************************* @@ -50,6 +51,7 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p) { tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; BTM_TRACE_EVENT ("btm_gen_resolve_paddr_cmpl"); + tBTM_STATUS status = BTM_SUCCESS; if (p) { /* set hash to be LSB of rpAddress */ @@ -62,10 +64,7 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p) p_cb->exist_addr_bit |= BTM_BLE_GAP_ADDR_BIT_RESOLVABLE; memcpy(p_cb->resolvale_addr, p_cb->private_addr, BD_ADDR_LEN); - if (p_cb->set_local_privacy_cback){ - (*p_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_SUCCESS); - p_cb->set_local_privacy_cback = NULL; - } + status = BTM_SET_PRIVACY_SUCCESS; /* start a periodical timer to refresh random addr */ btu_stop_timer_oneshot(&p_cb->raddr_timer_ent); @@ -79,11 +78,11 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p) } else { /* random address set failure */ BTM_TRACE_DEBUG("set random address failed"); - if (p_cb->set_local_privacy_cback){ - (*p_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL); - p_cb->set_local_privacy_cback = NULL; - } + status = BTM_SET_PRIVACY_FAIL; } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_BleLegacyGapOneshotFireIfArmed(BTM_BLE_LEGACY_GAP_SET_PRIVACY_EVT, &cb_params); } /******************************************************************************* ** @@ -221,7 +220,7 @@ static void btm_ble_resolve_address_cmpl(void) { tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; - BTM_TRACE_EVENT ("btm_ble_resolve_address_cmpl p_mgnt_cb->p_dev_rec = 0x%08x", (uint32_t)p_mgnt_cb->p_dev_rec); + BTM_TRACE_EVENT ("btm_ble_resolve_address_cmpl p_mgnt_cb->p_dev_rec = 0x%08x", p_mgnt_cb->p_dev_rec ? (uint32_t)p_mgnt_cb->p_dev_rec : 0); p_mgnt_cb->busy = FALSE; @@ -405,7 +404,9 @@ void btm_ble_resolve_random_addr(BD_ADDR random_bda, tBTM_BLE_RESOLVE_CBACK *p_c p_dev_rec = list_node(p_node); p_mgnt_cb->p_dev_rec = p_dev_rec; if (btm_ble_match_random_bda(p_dev_rec)) { - break; + // if matched, btm_ble_match_random_bda->btm_ble_proc_resolve_x->btm_ble_resolve_address_cmpl + p_mgnt_cb->p_dev_rec = NULL; + return; } p_mgnt_cb->p_dev_rec = NULL; } @@ -439,12 +440,12 @@ tBTM_SEC_DEV_REC *btm_find_dev_by_identity_addr(BD_ADDR bd_addr, UINT8 addr_type context.free_check = FALSE; p_node = list_foreach(btm_cb.p_sec_dev_rec_list, btm_find_sec_dev_in_list, &context); if (p_node) { - p_dev_rec = list_node(p_node); + p_dev_rec = list_node(p_node); if ((p_dev_rec->ble.static_addr_type & (~BLE_ADDR_TYPE_ID_BIT)) != (addr_type & (~BLE_ADDR_TYPE_ID_BIT))) { BTM_TRACE_WARNING("%s find pseudo->random match with diff addr type: %d vs %d", __func__, p_dev_rec->ble.static_addr_type, addr_type); - } + } } return p_dev_rec; #endif diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c b/components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c index 452d3b3a1a0..7a0e4dd7606 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c @@ -33,6 +33,7 @@ #include "l2c_int.h" #include "stack/hcimsgs.h" //#include "bt_utils.h" +#include "bta_dm_gap.h" #ifndef BTM_BLE_SCAN_PARAM_TOUT #define BTM_BLE_SCAN_PARAM_TOUT 50 /* 50 seconds */ @@ -278,8 +279,11 @@ void btm_enq_wl_dev_operation(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_TYPE ad ** the white list. ** *******************************************************************************/ -BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb) +BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type) { + BOOLEAN result = TRUE; + UINT8 status; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params; #if (BLE_50_FEATURE_SUPPORT == TRUE) if (addr_type > BLE_ADDR_RANDOM && addr_type != BLE_ADDR_ANONYMOUS) #else @@ -287,10 +291,9 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) { BTM_TRACE_ERROR("%s address type is error, unable to add device", __func__); - if (update_wl_cb){ - update_wl_cb(HCI_ERR_ILLEGAL_PARAMETER_FMT,to_add); - } - return FALSE; + status = HCI_ERR_ILLEGAL_PARAMETER_FMT; + result = FALSE; + goto _wl_end; } BD_ADDR invalid_rand_addr_a, invalid_rand_addr_b; @@ -319,10 +322,9 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ // do nothing } else { BTC_TRACE_ERROR(" controller not support resolvable address"); - if (update_wl_cb){ - update_wl_cb(HCI_ERR_ILLEGAL_PARAMETER_FMT,to_add); - } - return FALSE; + status = HCI_ERR_ILLEGAL_PARAMETER_FMT; + result = FALSE; + goto _wl_end; } } @@ -331,10 +333,9 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ if (to_add && p_cb->white_list_avail_size == 0) { BTM_TRACE_ERROR("%s Whitelist full, unable to add device", __func__); - if (update_wl_cb){ - update_wl_cb(HCI_ERR_MEMORY_FULL,to_add); - } - return FALSE; + status = HCI_ERR_MEMORY_FULL; + result = FALSE; + goto _wl_end; } #if (BLE_GATT_BGCONN == TRUE) @@ -342,27 +343,21 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ /* added the bd_addr to the connection hash map queue */ if(!background_connection_add((bt_bdaddr_t *)bd_addr)) { /* if the bd_addr already exist in whitelist, just callback return TRUE */ - if (update_wl_cb){ - update_wl_cb(HCI_SUCCESS,to_add); - } - return TRUE; + status = HCI_SUCCESS; + result = TRUE; + goto _wl_end; } } else { /* remove the bd_addr to the connection hash map queue */ if(!background_connection_remove((bt_bdaddr_t *)bd_addr)){ /* if the bd_addr don't exist in whitelist, just callback return TRUE */ - if (update_wl_cb){ - update_wl_cb(HCI_SUCCESS,to_add); - } - return TRUE; + status = HCI_SUCCESS; + result = TRUE; + goto _wl_end; } } #endif // (BLE_GATT_BGCONN == TRUE) - if (update_wl_cb){ - //save add whitelist complete callback - p_cb->update_wl_cb = update_wl_cb; - } /* stop the auto connect */ btm_suspend_wl_activity(p_cb->wl_state); /* save the bd_addr to the btm_cb env */ @@ -370,6 +365,13 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ /* save the ba_addr to the controller white list */ btm_wl_update_to_controller(); return TRUE; + +_wl_end: + memset(&cb_params, 0, sizeof(cb_params)); + cb_params.white_list_update.status = status; + cb_params.white_list_update.operation = to_add ? BTM_WHITELIST_ADD : BTM_WHITELIST_REMOVE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT, &cb_params); + return result; } /******************************************************************************* @@ -379,20 +381,14 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_ ** Description This function clears the white list. ** *******************************************************************************/ -void btm_ble_clear_white_list (tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb) +void btm_ble_clear_white_list (void) { - tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; - BTM_TRACE_EVENT ("btm_ble_clear_white_list"); btsnd_hcic_ble_clear_white_list(); #if (BLE_GATT_BGCONN == TRUE) background_connections_clear(); #endif // (BLE_GATT_BGCONN == TRUE) - - if (update_wl_cb) { - p_cb->update_wl_cb = update_wl_cb; - } } /******************************************************************************* @@ -417,9 +413,10 @@ void btm_ble_clear_white_list_complete(UINT8 *p_data, UINT16 evt_len) BTM_TRACE_ERROR ("%s failed, status 0x%x\n", __func__, status); } - if (p_cb->update_wl_cb) { - (*p_cb->update_wl_cb)(status, BTM_WHITELIST_CLEAR); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.white_list_update.status = status; + cb_params.white_list_update.operation = BTM_WHITELIST_CLEAR; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT, &cb_params); } /******************************************************************************* @@ -462,7 +459,6 @@ void btm_ble_periodic_adv_list_init(UINT8 periodic_adv_size) void btm_ble_add_2_white_list_complete(UINT8 status) { BTM_TRACE_EVENT("%s status=%d", __func__, status); - tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; if (status == HCI_SUCCESS) { // --btm_cb.ble_ctr_cb.white_list_avail_size; /* @@ -475,10 +471,10 @@ void btm_ble_add_2_white_list_complete(UINT8 status) */ } // add whitelist complete callback - if (p_cb->update_wl_cb) - { - (*p_cb->update_wl_cb)(status, BTM_WHITELIST_ADD); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.white_list_update.status = status; + cb_params.white_list_update.operation = BTM_WHITELIST_ADD; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT, &cb_params); } @@ -491,16 +487,16 @@ void btm_ble_add_2_white_list_complete(UINT8 status) *******************************************************************************/ void btm_ble_remove_from_white_list_complete(UINT8 *p, UINT16 evt_len) { - tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; UNUSED(evt_len); BTM_TRACE_EVENT ("%s status=%d", __func__, *p); if (*p == HCI_SUCCESS) { // ++btm_cb.ble_ctr_cb.white_list_avail_size; } - if (p_cb->update_wl_cb) - { - (*p_cb->update_wl_cb)(*p, BTM_WHITELIST_REMOVE); - } + + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.white_list_update.status = *p; + cb_params.white_list_update.operation = BTM_WHITELIST_REMOVE; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_WHITE_LIST_UPDATE_EVT, &cb_params); } #if (BLE_GATT_BGCONN == TRUE) @@ -619,11 +615,11 @@ BOOLEAN btm_ble_start_select_conn(BOOLEAN start, tBTM_BLE_SEL_CBACK *p_select_cb /* Process advertising packets only from devices in the white list */ /* use passive scan by default */ - if (!btsnd_hcic_ble_set_scan_params(BTM_BLE_SCAN_MODE_PASS, - scan_int, - scan_win, - p_cb->addr_mgnt_cb.own_addr_type, - SP_ADV_WL)) { + if (btsnd_hcic_ble_set_scan_params(BTM_BLE_SCAN_MODE_PASS, + scan_int, + scan_win, + p_cb->addr_mgnt_cb.own_addr_type, + SP_ADV_WL) != HCI_SUCCESS) { return FALSE; } #if (BLE_TOPOLOGY_CHECK == TRUE) @@ -636,7 +632,7 @@ BOOLEAN btm_ble_start_select_conn(BOOLEAN start, tBTM_BLE_SEL_CBACK *p_select_cb #if BLE_PRIVACY_SPT == TRUE btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN); #endif - if (!btsnd_hcic_ble_set_scan_enable(TRUE, TRUE)) { /* duplicate filtering enabled */ + if (btsnd_hcic_ble_set_scan_enable(TRUE, TRUE) != HCI_SUCCESS) { /* duplicate filtering enabled */ return FALSE; } /* mark up inquiry status flag */ diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c index 831dbf7c0a1..2446251dd54 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c @@ -37,6 +37,7 @@ #include "hci/hci_layer.h" #if BLE_INCLUDED == TRUE #include "l2c_int.h" +#include "bta_dm_gap.h" #include "stack/gattdefs.h" #include "gatt_int.h" @@ -59,8 +60,6 @@ #define BTM_BLE_GAP_ADV_RPT_BATCH_SIZE (10) - -tBTM_CallbackFunc conn_callback_func; // BLE vendor HCI event callback #if (BLE_VENDOR_HCI_EN == TRUE) static tBTM_BLE_VENDOR_HCI_EVT_CBACK *ble_vs_evt_callback = NULL; @@ -80,11 +79,11 @@ static UINT8 btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB *p_cb, BD_ADDR_PTR p_peer_addr_ptr, tBLE_ADDR_TYPE *p_peer_addr_type, tBLE_ADDR_TYPE *p_own_addr_type); -static void btm_ble_stop_discover(void); #if (BLE_42_SCAN_EN == TRUE) +static tBTM_STATUS btm_ble_stop_discover(void); static void btm_adv_pkt_handler(void *arg); #endif // #if (BLE_42_SCAN_EN == TRUE) -uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb); +uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type); #define BTM_BLE_INQ_RESULT 0x01 #define BTM_BLE_OBS_RESULT 0x02 @@ -247,105 +246,22 @@ const UINT8 btm_le_state_combo_tbl[BTM_BLE_STATE_MAX][BTM_BLE_STATE_MAX][2] = { #define BTM_LE_STATES_SUPPORTED(x, y, z) ((x)[(z)] & (y)) #endif // (BLE_TOPOLOGY_CHECK == TRUE) -#if (BLE_42_ADV_EN == TRUE) -static osi_mutex_t adv_enable_lock; -static osi_mutex_t adv_data_lock; -static osi_mutex_t adv_param_lock; -osi_sem_t adv_enable_sem; -osi_sem_t adv_data_sem; -osi_sem_t adv_param_sem; -uint8_t adv_enable_status = 0; -uint8_t adv_data_status = 0; -uint8_t adv_param_status = 0; -#endif // #if (BLE_42_ADV_EN == TRUE) - -#if (BLE_42_SCAN_EN == TRUE) -static osi_mutex_t scan_enable_lock; -static osi_mutex_t scan_param_lock; -osi_sem_t scan_enable_sem; -osi_sem_t scan_param_sem; -uint8_t scan_enable_status = 0; -uint8_t scan_param_status = 0; -#endif // #if (BLE_42_SCAN_EN == TRUE) +#if ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) +static osi_mutex_t btm_lock; +#endif // ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) void btm_ble_lock_init(void) { -#if (BLE_42_ADV_EN == TRUE) - osi_mutex_new(&adv_enable_lock); - osi_mutex_new(&adv_data_lock); - osi_mutex_new(&adv_param_lock); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_mutex_new(&scan_enable_lock); - osi_mutex_new(&scan_param_lock); -#endif // #if (BLE_42_SCAN_EN == TRUE) +#if ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) + osi_mutex_new(&btm_lock); +#endif // ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) } void btm_ble_lock_free(void) { -#if (BLE_42_ADV_EN == TRUE) - osi_mutex_free(&adv_enable_lock); - osi_mutex_free(&adv_data_lock); - osi_mutex_free(&adv_param_lock); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_mutex_free(&scan_enable_lock); - osi_mutex_free(&scan_param_lock); -#endif // #if (BLE_42_SCAN_EN == TRUE) -} - -void btm_ble_sem_init(void) -{ -#if (BLE_42_ADV_EN == TRUE) - osi_sem_new(&adv_enable_sem, 1, 0); - osi_sem_new(&adv_data_sem, 1, 0); - osi_sem_new(&adv_param_sem, 1, 0); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_sem_new(&scan_enable_sem, 1, 0); - osi_sem_new(&scan_param_sem, 1, 0); -#endif // #if (BLE_42_SCAN_EN == TRUE) -} - -void btm_ble_sem_free(void) -{ -#if (BLE_42_ADV_EN == TRUE) - osi_sem_free(&adv_enable_sem); - osi_sem_free(&adv_data_sem); - osi_sem_free(&adv_param_sem); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_sem_free(&scan_enable_sem); - osi_sem_free(&scan_param_sem); -#endif // #if (BLE_42_SCAN_EN == TRUE) -} - -/******************************************************************************* -** -** Function BTM_BleRegiseterConnParamCallback -** -** Description register connection parameters update callback func -** -** Returns void -** -*******************************************************************************/ -void BTM_BleRegiseterConnParamCallback(tBTM_UPDATE_CONN_PARAM_CBACK *update_conn_param_cb) -{ - conn_callback_func.update_conn_param_cb = update_conn_param_cb; -} - -/******************************************************************************* -** -** Function BTM_BleRegiseterPktLengthChangeCallback -** -** Description Registers a callback function for packet length changes. -** -** Returns void -** -*******************************************************************************/ -void BTM_BleRegiseterPktLengthChangeCallback(tBTM_SET_PKT_DATA_LENGTH_CBACK *ptk_len_chane_cb) -{ - conn_callback_func.set_pkt_data_length_cb = ptk_len_chane_cb; +#if ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) + osi_mutex_free(&btm_lock); +#endif // ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) } #if (BLE_VENDOR_HCI_EN == TRUE) @@ -364,9 +280,9 @@ void BTM_BleRegisterVendorHciEventCallback(tBTM_BLE_VENDOR_HCI_EVT_CBACK *vendor ** Returns void ** *******************************************************************************/ -BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR remote_bda, tBLE_ADDR_TYPE addr_type, tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb) +BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR remote_bda, tBLE_ADDR_TYPE addr_type) { - return btm_update_dev_to_white_list(add_remove, remote_bda, addr_type, update_wl_cb); + return btm_update_dev_to_white_list(add_remove, remote_bda, addr_type); } /******************************************************************************* @@ -378,9 +294,9 @@ BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR remote_bda, tBLE_A ** Returns void ** *******************************************************************************/ -void BTM_BleClearWhitelist(tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb) +void BTM_BleClearWhitelist(void) { - btm_ble_clear_white_list(update_wl_cb); + btm_ble_clear_white_list(); } #if (BLE_42_SCAN_EN == TRUE) @@ -454,8 +370,7 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration, } } } else if (BTM_BLE_IS_DISCO_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) { - status = BTM_CMD_STARTED; - btm_ble_stop_discover(); + status = btm_ble_stop_discover(); } else { BTM_TRACE_ERROR("%s scan not active\n", __func__); } @@ -468,63 +383,30 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration, #if (BLE_42_ADV_EN == TRUE) /******************************************************************************* ** -** Function BTM_BleBroadcast +** Function BTM_BleAdvStop ** -** Description This function is to start or stop broadcasting. +** Description This function is to stop broadcasting. ** -** Parameters start: start or stop broadcasting. +** Parameters void ** ** Returns status. ** *******************************************************************************/ -tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback) +tBTM_STATUS BTM_BleAdvStop(void) { tBTM_STATUS status = BTM_NO_RESOURCES; // tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; - tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; //UINT8 evt_type = p_cb->scan_rsp ? BTM_BLE_DISCOVER_EVT : BTM_BLE_NON_CONNECT_EVT; if (!controller_get_interface()->supports_ble()) { return BTM_ILLEGAL_VALUE; } -#ifdef BTM_BLE_PC_ADV_TEST_MODE - if (BTM_BLE_PC_ADV_TEST_MODE) { - evt_type = p_cb->scan_rsp ? BTM_BLE_CONNECT_EVT : BTM_BLE_NON_CONNECT_EVT; - } -#endif - - if (start) { -// "start" should not be true -#if (0) - /* update adv params */ - if (!btsnd_hcic_ble_write_adv_params ((UINT16)(p_cb->adv_interval_min ? p_cb->adv_interval_min : - BTM_BLE_GAP_ADV_INT), - (UINT16)(p_cb->adv_interval_max ? p_cb->adv_interval_max : - BTM_BLE_GAP_ADV_INT), - evt_type, - p_addr_cb->own_addr_type, - p_cb->direct_bda.type, - p_cb->direct_bda.bda, - p_cb->adv_chnl_map, - p_cb->afp)) - - { - status = BTM_NO_RESOURCES; - } else { - p_cb->evt_type = evt_type; - } - - status = btm_ble_start_adv (); -#endif // - } else { - //save the stop adv callback to the BTM env. - p_cb->p_stop_adv_cb = p_stop_adv_cback; - status = btm_ble_stop_adv(); + status = btm_ble_stop_adv(); #if BLE_PRIVACY_SPT == TRUE - btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE); + btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE); #endif - } + return status; } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -598,16 +480,11 @@ void BTM_BleEnableMixedPrivacyMode(BOOLEAN mixed_on) ** Returns BOOLEAN privacy mode set success; otherwise failed. ** *******************************************************************************/ -BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback) +BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode) { #if BLE_PRIVACY_SPT == TRUE tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; tBTM_LE_RANDOM_CB *random_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; - if (random_cb){ - random_cb->set_local_privacy_cback = set_local_privacy_cback; - }else{ - BTM_TRACE_ERROR("%s,random_cb = NULL", __func__); - } BTM_TRACE_EVENT ("%s\n", __func__); @@ -616,6 +493,12 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK return FALSE; } + if (random_cb){ + BTM_BleLegacyGapOneshotArm(BTM_BLE_LEGACY_GAP_SET_PRIVACY_EVT); + }else{ + BTM_TRACE_ERROR("%s,random_cb = NULL", __func__); + } + #if (defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE) uint8_t addr_resolution = 0; #endif /* defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */ @@ -723,14 +606,14 @@ void BTM_BleSetStaticAddr(BD_ADDR rand_addr) } #if (CONTROLLER_RPA_LIST_ENABLE == FALSE) -uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb) +uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type) { if(*own_bda_type == BLE_ADDR_RANDOM) { if((btm_cb.ble_ctr_cb.addr_mgnt_cb.exist_addr_bit & BTM_BLE_GAP_ADDR_BIT_RANDOM) == BTM_BLE_GAP_ADDR_BIT_RANDOM) { //close privacy #if BLE_PRIVACY_SPT == TRUE if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) { - BTM_BleConfigPrivacy(FALSE, NULL); + BTM_BleConfigPrivacy(FALSE); } #endif btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type = BLE_ADDR_RANDOM; @@ -744,9 +627,6 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK * btsnd_hcic_ble_set_random_addr(btm_cb.ble_ctr_cb.addr_mgnt_cb.resolvale_addr); }else { BTM_TRACE_ERROR ("No random address yet, please set random address using API \"esp_ble_gap_set_rand_addr\" and retry\n"); - if(cb) { - (* cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } } else if(*own_bda_type == BLE_ADDR_PUBLIC_ID || *own_bda_type == BLE_ADDR_RANDOM_ID) { @@ -759,9 +639,6 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK * #if BLE_PRIVACY_SPT == TRUE if(btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) { BTM_TRACE_ERROR ("Error state\n"); - if(cb) { - (* cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } #endif @@ -776,9 +653,6 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK * btsnd_hcic_ble_set_random_addr(btm_cb.ble_ctr_cb.addr_mgnt_cb.static_rand_addr); } else { BTM_TRACE_ERROR ("No RPA and no random address yet, please set RPA or random address and try\n"); - if(cb) { - (* cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } } @@ -790,25 +664,19 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK * return BTM_SUCCESS; } #else -uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb) +uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type) { tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; if((*own_bda_type == BLE_ADDR_RANDOM) || (*own_bda_type == BLE_ADDR_RANDOM_ID)) { if((p_cb->exist_addr_bit & BTM_BLE_GAP_ADDR_BIT_RANDOM) != BTM_BLE_GAP_ADDR_BIT_RANDOM) { BTM_TRACE_ERROR("No random address yet, please set random address and try\n"); - if(cb) { - (* cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } // If a device is using RPA, it shall also have an Identity Address if ((*own_bda_type == BLE_ADDR_RANDOM_ID) && BTM_BLE_IS_NON_RESLVE_BDA(p_cb->static_rand_addr)) { BTM_TRACE_ERROR("No identity address yet, please set static random address and try\n"); - if (cb) { - (* cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } } @@ -917,7 +785,7 @@ static void btm_ble_resolve_random_addr_on_adv(void *p_rec, void *p) tBTM_SEC_DEV_REC *match_rec = (tBTM_SEC_DEV_REC *) p_rec; UINT8 addr_type = BLE_ADDR_RANDOM; BD_ADDR bda; - UINT8 *pp = (UINT8 *)p + 1; + UINT8 *pp = (UINT8 *)p; UINT8 evt_type; BTM_TRACE_EVENT ("btm_ble_resolve_random_addr_on_adv "); @@ -937,6 +805,7 @@ static void btm_ble_resolve_random_addr_on_adv(void *p_rec, void *p) // Assign the original address to be the current report address memcpy(bda, match_rec->ble.pseudo_addr, BD_ADDR_LEN); } + addr_type = match_rec->ble.ble_addr_type; } btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, pp); @@ -1042,7 +911,7 @@ BOOLEAN BTM_BleSetBgConnType(tBTM_BLE_CONN_TYPE bg_conn_type, void BTM_BleClearBgConnDev(void) { btm_ble_start_auto_conn(FALSE); - btm_ble_clear_white_list(NULL); + btm_ble_clear_white_list(); gatt_reset_bgdev_list(); } #endif // #if (GATT_BG_CONN_DEV == TRUE) @@ -1065,7 +934,7 @@ void BTM_BleClearBgConnDev(void) BOOLEAN BTM_BleUpdateBgConnDev(BOOLEAN add_remove, BD_ADDR remote_bda) { BTM_TRACE_EVENT("%s() add=%d", __func__, add_remove); - return btm_update_dev_to_white_list(add_remove, remote_bda, 0, NULL); + return btm_update_dev_to_white_list(add_remove, remote_bda, 0); } #if 0 /******************************************************************************* @@ -1112,7 +981,6 @@ static UINT8 btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB *p_cb, { UINT8 evt_type; #if BLE_PRIVACY_SPT == TRUE - UINT8 i = BTM_SEC_MAX_DEVICE_RECORDS; tBTM_SEC_DEV_REC *p_dev_rec; list_node_t *p_node = NULL; #endif ///BLE_PRIVACY_SPT == TRUE @@ -1165,14 +1033,12 @@ static UINT8 btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB *p_cb, memcpy(p_peer_addr_ptr, p_dev_rec->ble.static_addr, BD_ADDR_LEN); *p_peer_addr_type = p_dev_rec->ble.static_addr_type; break; - } - } + } + } - if (i != BTM_SEC_MAX_DEVICE_RECORDS) { + if (p_node) { *p_own_addr_type = BLE_ADDR_RANDOM_ID; - } else - /* resolving list is empty, not enabled */ - { + } else { *p_own_addr_type = BLE_ADDR_RANDOM; } } @@ -1191,7 +1057,7 @@ static UINT8 btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB *p_cb, #if (BLE_42_ADV_EN == TRUE) /******************************************************************************* ** -** Function BTM_BleSetAdvParamsAll +** Function BTM_BleStartAdvWithParams ** ** Description This function is called to set all of the advertising parameters. ** @@ -1200,33 +1066,30 @@ static UINT8 btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB *p_cb, ** Returns void ** *******************************************************************************/ -tBTM_STATUS BTM_BleSetAdvParamsAll(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, +tBTM_STATUS BTM_BleStartAdvWithParams(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda, - tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb) + tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp) { tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; - BTM_TRACE_EVENT ("BTM_BleSetAdvParamsAll\n"); + BTM_TRACE_EVENT ("BTM_BleStartAdvWithParams\n"); if (!controller_get_interface()->supports_ble()) { return BTM_ILLEGAL_VALUE; } - if (BTM_BleUpdateOwnType(&own_bda_type, adv_cb) != 0) { + if (BTM_BleUpdateOwnType(&own_bda_type) != 0) { return BTM_ILLEGAL_VALUE; } if (!BTM_BLE_ISVALID_PARAM(adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) || !BTM_BLE_ISVALID_PARAM(adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) { BTM_TRACE_ERROR ("adv_int_min or adv_int_max is invalid\n"); - if(adv_cb) { - (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL); - } return BTM_ILLEGAL_VALUE; } btm_ble_stop_adv(); - osi_mutex_lock(&adv_param_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); #if (BLE_TOPOLOGY_CHECK == TRUE) if(adv_type == BTM_BLE_CONNECT_DIR_EVT){ btm_ble_set_topology_mask(BTM_BLE_STATE_HI_DUTY_DIR_ADV_BIT); @@ -1242,11 +1105,11 @@ tBTM_STATUS BTM_BleSetAdvParamsAll(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 p_addr_cb->own_addr_type = own_bda_type; p_cb->evt_type = adv_type; p_cb->afp = afp; - p_cb->p_adv_cb = adv_cb; if (p_dir_bda) { memcpy(&p_cb->direct_bda, p_dir_bda, sizeof(tBLE_BD_ADDR)); } else { + osi_mutex_unlock(&btm_lock); return BTM_ILLEGAL_VALUE; } @@ -1261,13 +1124,11 @@ tBTM_STATUS BTM_BleSetAdvParamsAll(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 p_dir_bda->type, p_dir_bda->bda, chnl_map, - p_cb->afp)) { - osi_sem_take(&adv_param_sem, OSI_SEM_MAX_TIMEOUT); - status = adv_param_status; - } else { + p_cb->afp) != HCI_SUCCESS) { status = BTM_NO_RESOURCES; } - osi_mutex_unlock(&adv_param_lock); + + osi_mutex_unlock(&btm_lock); return status; } @@ -1288,8 +1149,7 @@ tBTM_STATUS BTM_BleStartAdv(void) #if (BLE_42_SCAN_EN == TRUE) tBTM_STATUS BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window, - tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy, - tBLE_SCAN_PARAM_SETUP_CBACK scan_setup_status_cback) + tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy) { tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; UINT32 max_scan_interval; @@ -1300,7 +1160,7 @@ tBTM_STATUS BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, if (!controller_get_interface()->supports_ble()) { return BTM_ILLEGAL_VALUE; } - if (BTM_BleUpdateOwnType(&addr_type_own, NULL) != 0) { + if (BTM_BleUpdateOwnType(&addr_type_own) != 0) { return BTM_ILLEGAL_VALUE; } @@ -1308,33 +1168,34 @@ tBTM_STATUS BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, max_scan_window = BTM_BLE_SCAN_WIN_MAX; - osi_mutex_lock(&scan_param_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); if (BTM_BLE_ISVALID_PARAM(scan_interval, BTM_BLE_SCAN_INT_MIN, max_scan_interval) && BTM_BLE_ISVALID_PARAM(scan_window, BTM_BLE_SCAN_WIN_MIN, max_scan_window) && (scan_mode == BTM_BLE_SCAN_MODE_ACTI || scan_mode == BTM_BLE_SCAN_MODE_PASS) && (scan_duplicate_filter < BTM_BLE_SCAN_DUPLICATE_MAX) && (scan_window <= scan_interval)) { - p_cb->scan_type = scan_mode; - p_cb->scan_interval = scan_interval; - p_cb->scan_window = scan_window; - p_cb->sfp = scan_filter_policy; - p_cb->scan_params_set = TRUE; - p_cb->scan_duplicate_filter = scan_duplicate_filter; - - if (btsnd_hcic_ble_set_scan_params(p_cb->scan_type, (UINT16)scan_interval, + if ((btsnd_hcic_ble_set_scan_params(scan_mode, (UINT16)scan_interval, (UINT16)scan_window, addr_type_own, - scan_filter_policy)) { - osi_sem_take(&scan_param_sem, OSI_SEM_MAX_TIMEOUT); - ret = scan_param_status; + scan_filter_policy)) != HCI_SUCCESS) { + ret = BTM_ILLEGAL_VALUE; + BTM_TRACE_ERROR("Illegal params: scan_interval = %d scan_window = %d\n", + scan_interval, scan_window); + } else { + p_cb->scan_type = scan_mode; + p_cb->scan_interval = scan_interval; + p_cb->scan_window = scan_window; + p_cb->sfp = scan_filter_policy; + p_cb->scan_params_set = TRUE; + p_cb->scan_duplicate_filter = scan_duplicate_filter; } } else { ret = BTM_ILLEGAL_VALUE; - BTM_TRACE_ERROR("Illegal params: scan_interval = %d scan_window = %d\n", + BTM_TRACE_ERROR("Invalid params: scan_interval = %d scan_window = %d\n", scan_interval, scan_window); } - osi_mutex_unlock(&scan_param_lock); + osi_mutex_unlock(&btm_lock); return ret; } #endif // #if (BLE_42_SCAN_EN == TRUE) @@ -1363,7 +1224,7 @@ tBTM_STATUS BTM_BleWriteScanRsp(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p return BTM_ILLEGAL_VALUE; } - osi_mutex_lock(&adv_data_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); memset(rsp_data, 0, BTM_BLE_AD_DATA_LEN); btm_ble_build_adv_data(&data_mask, &p, p_data); if (data_mask != 0) { @@ -1371,20 +1232,20 @@ tBTM_STATUS BTM_BleWriteScanRsp(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p BTM_TRACE_WARNING("%s, Partial data write into ADV", __func__); } - if (btsnd_hcic_ble_set_scan_rsp_data((UINT8)(p - rsp_data), rsp_data)) { - osi_sem_take(&adv_data_sem, OSI_SEM_MAX_TIMEOUT); - ret = adv_data_status; - - if (adv_data_status == BTM_SUCCESS && data_mask != 0) { - btm_cb.ble_ctr_cb.inq_var.scan_rsp = TRUE; - } else { - btm_cb.ble_ctr_cb.inq_var.scan_rsp = FALSE; - } - } else { + if (btsnd_hcic_ble_set_scan_rsp_data((UINT8)(p - rsp_data), rsp_data) != HCI_SUCCESS) { ret = BTM_ILLEGAL_VALUE; + btm_cb.ble_ctr_cb.inq_var.scan_rsp = FALSE; + } else { + ret = BTM_SUCCESS; } - osi_mutex_unlock(&adv_data_lock); + if (ret == BTM_SUCCESS && data_mask != 0) { + btm_cb.ble_ctr_cb.inq_var.scan_rsp = TRUE; + } else { + btm_cb.ble_ctr_cb.inq_var.scan_rsp = FALSE; + } + + osi_mutex_unlock(&btm_lock); return ret; } @@ -1401,16 +1262,13 @@ tBTM_STATUS BTM_BleWriteScanRsp(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p *******************************************************************************/ tBTM_STATUS BTM_BleWriteScanRspRaw(UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len) { - tBTM_STATUS ret; + tBTM_STATUS ret = BTM_SUCCESS; - osi_mutex_lock(&adv_data_lock, OSI_MUTEX_MAX_TIMEOUT); - if (btsnd_hcic_ble_set_scan_rsp_data((UINT8)raw_scan_rsp_len, p_raw_scan_rsp)) { - osi_sem_take(&adv_data_sem, OSI_SEM_MAX_TIMEOUT); - ret = adv_data_status; - } else { + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); + if (btsnd_hcic_ble_set_scan_rsp_data((UINT8)raw_scan_rsp_len, p_raw_scan_rsp) != HCI_SUCCESS) { ret = BTM_NO_RESOURCES; } - osi_mutex_unlock(&adv_data_lock); + osi_mutex_unlock(&btm_lock); return ret; } @@ -1426,19 +1284,15 @@ tBTM_STATUS BTM_BleWriteScanRspRaw(UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_le ** Parameters: subcode: add, remove or clean duplicate scan exceptional list. ** type: device info type ** device_info: device information -** update_exceptional_list_cmp_cb: complete callback +** ** ** Returns status ** *******************************************************************************/ -tBTM_STATUS BTM_UpdateBleDuplicateExceptionalList(uint8_t subcode, uint32_t type, BD_ADDR device_info, - tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK update_exceptional_list_cmp_cb) +tBTM_STATUS BTM_UpdateBleDuplicateExceptionalList(uint8_t subcode, uint32_t type, BD_ADDR device_info) { - tBTM_BLE_CB *ble_cb = &btm_cb.ble_ctr_cb; tBTM_STATUS status = BTM_NO_RESOURCES; - ble_cb->update_exceptional_list_cmp_cb = update_exceptional_list_cmp_cb; - if (!controller_get_interface()->supports_ble()) { return BTM_ILLEGAL_VALUE; } @@ -1500,14 +1354,14 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p tBTM_BLE_LOCAL_ADV_DATA *p_cb_data = &btm_cb.ble_ctr_cb.inq_var.adv_data; UINT8 *p; tBTM_BLE_AD_MASK mask = data_mask; - tBTM_STATUS ret; + tBTM_STATUS ret = BTM_SUCCESS; BTM_TRACE_EVENT ("BTM_BleWriteAdvData "); if (!controller_get_interface()->supports_ble()) { return BTM_ILLEGAL_VALUE; } - osi_mutex_lock(&adv_data_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); memset(p_cb_data, 0, sizeof(tBTM_BLE_LOCAL_ADV_DATA)); p = p_cb_data->ad_data; p_cb_data->data_mask = data_mask; @@ -1523,14 +1377,11 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p p_cb_data->data_mask &= ~mask; - if (btsnd_hcic_ble_set_adv_data((UINT8)(p_cb_data->p_pad - p_cb_data->ad_data), - p_cb_data->ad_data)) { - osi_sem_take(&adv_data_sem, OSI_SEM_MAX_TIMEOUT); - ret = adv_data_status; - } else { + if ((btsnd_hcic_ble_set_adv_data((UINT8)(p_cb_data->p_pad - p_cb_data->ad_data), + p_cb_data->ad_data)) != HCI_SUCCESS) { ret = BTM_NO_RESOURCES; } - osi_mutex_unlock(&adv_data_lock); + osi_mutex_unlock(&btm_lock); return ret; } @@ -1547,15 +1398,12 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK data_mask, tBTM_BLE_ADV_DATA *p *******************************************************************************/ tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len) { - tBTM_STATUS ret; - osi_mutex_lock(&adv_data_lock, OSI_MUTEX_MAX_TIMEOUT); - if (btsnd_hcic_ble_set_adv_data((UINT8)raw_adv_len, p_raw_adv)) { - osi_sem_take(&adv_data_sem, OSI_SEM_MAX_TIMEOUT); - ret = adv_data_status; - } else { + tBTM_STATUS ret = BTM_SUCCESS; + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); + if ((btsnd_hcic_ble_set_adv_data((UINT8)raw_adv_len, p_raw_adv)) != HCI_SUCCESS) { ret = BTM_NO_RESOURCES; } - osi_mutex_unlock(&adv_data_lock); + osi_mutex_unlock(&btm_lock); return ret; } @@ -1981,7 +1829,7 @@ UINT8 *btm_ble_build_adv_data(tBTM_BLE_AD_MASK *p_data_mask, UINT8 **p_dst, } /* 16bits/32bits/128bits Service Data */ if (len > MIN_ADV_LENGTH && data_mask & BTM_BLE_AD_BIT_SERVICE_DATA && - p_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) { + p_data && p_data->p_service_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) { if (len > (p_data->p_service_data->service_uuid.len + MIN_ADV_LENGTH)) { if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH)) { cp_len = len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len; @@ -2217,14 +2065,14 @@ tBTM_STATUS btm_ble_set_discoverability(UINT16 combined_mode) #endif // #if (BLE_42_ADV_EN == TRUE) /* update adv params */ - if (!btsnd_hcic_ble_write_adv_params (adv_int_min, + if (btsnd_hcic_ble_write_adv_params (adv_int_min, adv_int_max, evt_type, own_addr_type, init_addr_type, p_addr_ptr, p_cb->adv_chnl_map, - p_cb->afp)) { + p_cb->afp) != HCI_SUCCESS) { status = BTM_NO_RESOURCES; } else { p_cb->evt_type = evt_type; @@ -2315,14 +2163,14 @@ tBTM_STATUS btm_ble_set_connectability(UINT16 combined_mode) btm_ble_stop_adv(); #endif // #if (BLE_42_ADV_EN == TRUE) - if (!btsnd_hcic_ble_write_adv_params (adv_int_min, + if (btsnd_hcic_ble_write_adv_params (adv_int_min, adv_int_max, evt_type, own_addr_type, peer_addr_type, p_addr_ptr, p_cb->adv_chnl_map, - p_cb->afp)) { + p_cb->afp) != HCI_SUCCESS) { status = BTM_NO_RESOURCES; } else { p_cb->evt_type = evt_type; @@ -2501,7 +2349,7 @@ static void btm_ble_update_adv_flag(UINT8 flag) } if (btsnd_hcic_ble_set_adv_data((UINT8)(p_adv_data->p_pad - p_adv_data->ad_data), - p_adv_data->ad_data)) { + p_adv_data->ad_data) == HCI_SUCCESS) { p_adv_data->data_mask |= BTM_BLE_AD_BIT_FLAGS; } @@ -3065,7 +2913,7 @@ static void btm_adv_pkt_handler(void *arg) STREAM_TO_UINT8 (hci_evt_len, p); STREAM_TO_UINT8 (ble_sub_code, p); if (ble_sub_code == HCI_BLE_ADV_PKT_RPT_EVT) { - btm_ble_process_adv_pkt(p); + btm_ble_process_adv_pkt(p, hci_evt_len); } else if (ble_sub_code == HCI_BLE_ADV_DISCARD_REPORT_EVT) { btm_ble_process_adv_discard_evt(p); } else if (ble_sub_code == HCI_BLE_DIRECT_ADV_EVT) { @@ -3085,7 +2933,6 @@ static void btm_adv_pkt_handler(void *arg) } UNUSED(hci_evt_code); - UNUSED(hci_evt_len); } /******************************************************************************* @@ -3101,7 +2948,7 @@ static void btm_adv_pkt_handler(void *arg) ** Returns void ** *******************************************************************************/ -void btm_ble_process_adv_pkt (UINT8 *p_data) +void btm_ble_process_adv_pkt (UINT8 *p_data, UINT8 evt_len) { BD_ADDR bda; UINT8 evt_type = 0, *p = p_data; @@ -3121,16 +2968,30 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) return; } + /* sub_code(1) already consumed by caller, need at least num_reports(1) */ + if (evt_len < 2) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: evt too short (len=%u)", evt_len); + return; + } + /* Extract the number of reports in this event. */ STREAM_TO_UINT8(num_reports, p); + UINT8 remaining = evt_len - 2; while (num_reports--) { + /* Per-report minimum: evt_type(1) + addr_type(1) + bda(6) + data_len(1) + rssi(1) = 10 */ + if (remaining < 10) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: remaining %u too short for report", remaining); + break; + } +#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) + /* Save current report start position for address resolution callback */ + UINT8 *pp = p; +#endif /* Extract inquiry results */ STREAM_TO_UINT8 (evt_type, p); STREAM_TO_UINT8 (addr_type, p); STREAM_TO_BDADDR (bda, p); - //BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n", - // bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]); #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) #if (!CONTROLLER_RPA_LIST_ENABLE) @@ -3140,17 +3001,21 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) /* map address to security record */ match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE); - - // BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n", - // bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]); - /* always do RRA resolution on host */ +#endif + /* Validate data_len before any path (callee reads 1 + data_len + 1 = data_len+2 bytes from p) */ + data_len = *p; /* read without advancing; p points to data_len byte */ + if (data_len + 2 > remaining - 8) { + BTM_TRACE_ERROR("btm_ble_process_adv_pkt: data_len %u + data + rssi exceeds remaining %u", data_len, (UINT16)(remaining - 8)); + break; + } +#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) + /* RRA path: resolve first, btm_ble_process_adv_pkt_cont will be called from callback; else process now */ if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) { - btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data); + btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, pp); } else #endif btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p); #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE && (!CONTROLLER_RPA_LIST_ENABLE)) - //save current adv addr information if p_dev_rec!= NULL tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda); if(p_dev_rec) { p_dev_rec->ble.current_addr_type = temp_addr_type; @@ -3159,9 +3024,11 @@ void btm_ble_process_adv_pkt (UINT8 *p_data) } #endif STREAM_TO_UINT8(data_len, p); + remaining -= 9; /* evt_type(1) + addr_type(1) + bda(6) + data_len(1) */ /* Advance to the next event data_len + rssi byte */ p += data_len + 1; + remaining -= (data_len + 1); } } @@ -3368,19 +3235,15 @@ tBTM_STATUS btm_ble_start_scan(void) tBTM_BLE_INQ_CB *p_inq = &btm_cb.ble_ctr_cb.inq_var; tBTM_STATUS status = BTM_CMD_STARTED; - osi_mutex_lock(&scan_enable_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); if(p_inq->scan_duplicate_filter > BTM_BLE_DUPLICATE_MAX) { p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE; } /* start scan, disable duplicate filtering */ - if (!btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, p_inq->scan_duplicate_filter)) { + if ((btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, p_inq->scan_duplicate_filter)) != HCI_SUCCESS) { status = BTM_NO_RESOURCES; } else { - osi_sem_take(&scan_enable_sem, OSI_SEM_MAX_TIMEOUT); - if(scan_enable_status != BTM_SUCCESS) { - status = BTM_NO_RESOURCES; - } btm_cb.ble_ctr_cb.inq_var.state |= BTM_BLE_SCANNING; #if (BLE_TOPOLOGY_CHECK == TRUE) if (p_inq->scan_type == BTM_BLE_SCAN_MODE_ACTI) { @@ -3390,7 +3253,7 @@ tBTM_STATUS btm_ble_start_scan(void) } #endif // (BLE_TOPOLOGY_CHECK == TRUE) } - osi_mutex_unlock(&scan_enable_lock); + osi_mutex_unlock(&btm_lock); return status; } #endif // #if (BLE_42_SCAN_EN == TRUE) @@ -3412,13 +3275,16 @@ void btm_ble_stop_scan(void) btm_cb.ble_ctr_cb.inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE; btm_cb.ble_ctr_cb.inq_var.state &= ~BTM_BLE_SCANNING; /* stop discovery now */ - btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE); + if (btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE) != HCI_SUCCESS) { + BTM_TRACE_WARNING("stop scan failed\n"); + } btm_update_scanner_filter_policy(SP_ADV_ALL); btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_SCAN; } +#if (BLE_42_SCAN_EN == TRUE) /******************************************************************************* ** ** Function btm_ble_stop_observe @@ -3428,14 +3294,15 @@ void btm_ble_stop_scan(void) ** Returns void ** *******************************************************************************/ -static void btm_ble_stop_discover(void) +static tBTM_STATUS btm_ble_stop_discover(void) { -#if (BLE_42_SCAN_EN == TRUE) + tBTM_STATUS status = BTM_CMD_STARTED; tBTM_BLE_CB *p_ble_cb = & btm_cb.ble_ctr_cb; - tBTM_CMPL_CB *p_scan_cb = p_ble_cb->p_scan_cmpl_cb; btu_stop_timer (&p_ble_cb->scan_timer_ent); - osi_mutex_lock(&scan_enable_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); + + tBTM_CMPL_CB *p_scan_cb = p_ble_cb->p_scan_cmpl_cb; p_ble_cb->scan_activity &= ~BTM_LE_DISCOVER_ACTIVE; p_ble_cb->p_scan_results_cb = NULL; @@ -3445,8 +3312,8 @@ static void btm_ble_stop_discover(void) /* Clear the inquiry callback if set */ btm_cb.ble_ctr_cb.inq_var.state &= ~BTM_BLE_SCANNING; /* stop discovery now */ - if(btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE)) { - osi_sem_take(&scan_enable_sem, OSI_SEM_MAX_TIMEOUT); + if (btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE) != HCI_SUCCESS) { + status = BTM_NO_RESOURCES; } #if (BLE_TOPOLOGY_CHECK == TRUE) /* reset status */ @@ -3455,12 +3322,19 @@ static void btm_ble_stop_discover(void) #endif // (BLE_TOPOLOGY_CHECK == TRUE) } + /* Copy completion info and unlock before invoking callback to avoid deadlock: + * callback may call BTM APIs that take btm_lock (non-recursive mutex). */ + tBTM_INQUIRY_CMPL inq_cmpl_info; + memcpy(&inq_cmpl_info, &btm_cb.btm_inq_vars.inq_cmpl_info, sizeof(inq_cmpl_info)); + osi_mutex_unlock(&btm_lock); + if (p_scan_cb) { - (p_scan_cb)((tBTM_INQUIRY_CMPL *) &btm_cb.btm_inq_vars.inq_cmpl_info); + (p_scan_cb)((tBTM_INQUIRY_CMPL *) &inq_cmpl_info); } - osi_mutex_unlock(&scan_enable_lock); -#endif // #if (BLE_42_SCAN_EN == TRUE) + + return status; } +#endif // #if (BLE_42_SCAN_EN == TRUE) /******************************************************************************* ** @@ -3519,7 +3393,7 @@ static BOOLEAN btm_ble_adv_states_operation(BTM_TOPOLOGY_FUNC_PTR *p_handler, UI tBTM_STATUS btm_ble_start_adv(void) { tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; - tBTM_STATUS rt = BTM_NO_RESOURCES; + tBTM_STATUS rt = BTM_SUCCESS; BTM_TRACE_EVENT ("btm_ble_start_adv\n"); #if (BLE_TOPOLOGY_CHECK == TRUE) @@ -3528,7 +3402,7 @@ tBTM_STATUS btm_ble_start_adv(void) } #endif // (BLE_TOPOLOGY_CHECK == TRUE) - osi_mutex_lock(&adv_enable_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) /* To relax resolving list, always have resolving list enabled, unless directed adv */ @@ -3539,6 +3413,7 @@ tBTM_STATUS btm_ble_start_adv(void) //btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_ADV); } #endif + UINT8 wl_state = btm_cb.ble_ctr_cb.wl_state; if (p_cb->afp != AP_SCAN_CONN_ALL) { //find the device in the btm dev buffer and write it to the controller white list btm_execute_wl_dev_operation(); @@ -3553,24 +3428,16 @@ tBTM_STATUS btm_ble_start_adv(void) #if (BLE_TOPOLOGY_CHECK == TRUE) btm_ble_adv_states_operation(btm_ble_set_topology_mask, p_cb->evt_type); #endif // (BLE_TOPOLOGY_CHECK == TRUE) - if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE)) { - osi_sem_take(&adv_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = adv_enable_status; - BTM_TRACE_EVENT ("BTM_SUCCESS\n"); - } else { - p_cb->adv_mode = BTM_BLE_ADV_DISABLE; + if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE) != HCI_SUCCESS) { + rt = BTM_NO_RESOURCES; p_cb->state = temp_state; p_cb->adv_mode = adv_mode; #if (BLE_TOPOLOGY_CHECK == TRUE) btm_ble_adv_states_operation(btm_ble_clear_topology_mask, p_cb->evt_type); #endif // (BLE_TOPOLOGY_CHECK == TRUE) - btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV; + btm_cb.ble_ctr_cb.wl_state = wl_state; } - - if(adv_enable_status != HCI_SUCCESS) { - p_cb->adv_mode = adv_mode; - } - osi_mutex_unlock(&adv_enable_lock); + osi_mutex_unlock(&btm_lock); return rt; } @@ -3588,7 +3455,7 @@ tBTM_STATUS btm_ble_stop_adv(void) tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; tBTM_STATUS rt = BTM_SUCCESS; if (p_cb) { - osi_mutex_lock(&adv_enable_lock, OSI_MUTEX_MAX_TIMEOUT); + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); UINT8 temp_adv_mode = p_cb->adv_mode; BOOLEAN temp_fast_adv_on = p_cb->fast_adv_on; tBTM_BLE_GAP_STATE temp_state = p_cb->state; @@ -3605,10 +3472,7 @@ tBTM_STATUS btm_ble_stop_adv(void) /* clear all adv states */ btm_ble_clear_topology_mask (BTM_BLE_STATE_ALL_ADV_MASK); #endif // (BLE_TOPOLOGY_CHECK == TRUE) - if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) { - osi_sem_take(&adv_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = adv_enable_status; - } else { + if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE) != HCI_SUCCESS) { // reset state p_cb->fast_adv_on = temp_fast_adv_on; p_cb->adv_mode = temp_adv_mode; @@ -3619,10 +3483,10 @@ tBTM_STATUS btm_ble_stop_adv(void) #endif // (BLE_TOPOLOGY_CHECK == TRUE) rt = BTM_NO_RESOURCES; } - if(adv_enable_status != HCI_SUCCESS) { + if(rt != HCI_SUCCESS) { p_cb->adv_mode = temp_adv_mode; } - osi_mutex_unlock(&adv_enable_lock); + osi_mutex_unlock(&btm_lock); } return rt; } @@ -3631,31 +3495,24 @@ tBTM_STATUS btm_ble_stop_adv(void) tBTM_STATUS btm_ble_set_random_addr(BD_ADDR random_bda) { tBTM_STATUS rt = BTM_SUCCESS; -#if (BLE_42_ADV_EN == TRUE) - osi_mutex_lock(&adv_enable_lock, OSI_MUTEX_MAX_TIMEOUT); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_mutex_lock(&scan_enable_lock, OSI_MUTEX_MAX_TIMEOUT); -#endif // #if (BLE_42_SCAN_EN == TRUE) +#if ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) + osi_mutex_lock(&btm_lock, OSI_MUTEX_MAX_TIMEOUT); +#endif // ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) #if (BLE_42_ADV_EN == TRUE) if (btm_cb.ble_ctr_cb.inq_var.adv_mode == BTM_BLE_ADV_ENABLE) { - if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) { - osi_sem_take(&adv_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = adv_enable_status; - } else { + if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE) != HCI_SUCCESS) { rt = BTM_BAD_VALUE_RET; + BTM_TRACE_WARNING ("Disable ADV failed"); } } #endif // #if (BLE_42_ADV_EN == TRUE) #if (BLE_42_SCAN_EN == TRUE) if (BTM_BLE_IS_DISCO_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) { - if (btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_SCAN_DUPLICATE_DISABLE)) { - osi_sem_take(&scan_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = scan_enable_status; - } else { + if ((btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_SCAN_DUPLICATE_DISABLE)) != HCI_SUCCESS) { rt = BTM_BAD_VALUE_RET; + BTM_TRACE_WARNING ("Disable scan failed"); } } #endif // #if (BLE_42_SCAN_EN == TRUE) @@ -3666,37 +3523,30 @@ tBTM_STATUS btm_ble_set_random_addr(BD_ADDR random_bda) #if (BLE_42_ADV_EN == TRUE) if (btm_cb.ble_ctr_cb.inq_var.adv_mode == BTM_BLE_ADV_ENABLE) { - if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE)) { - osi_sem_take(&adv_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = adv_enable_status; - } else { + if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE) != HCI_SUCCESS) { rt = BTM_BAD_VALUE_RET; + BTM_TRACE_WARNING ("restart adv failed"); } } #endif // #if (BLE_42_ADV_EN == TRUE) #if (BLE_42_SCAN_EN == TRUE) if (BTM_BLE_IS_DISCO_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) { - if (btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, btm_cb.ble_ctr_cb.inq_var.scan_duplicate_filter)) { - osi_sem_take(&scan_enable_sem, OSI_SEM_MAX_TIMEOUT); - rt = scan_enable_status; - } else { + if ((btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, btm_cb.ble_ctr_cb.inq_var.scan_duplicate_filter)) != HCI_SUCCESS) { rt = BTM_BAD_VALUE_RET; + BTM_TRACE_WARNING ("restart scan failed"); } } #endif // #if (BLE_42_SCAN_EN == TRUE) -#if (BLE_42_ADV_EN == TRUE) - osi_mutex_unlock(&adv_enable_lock); -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - osi_mutex_unlock(&scan_enable_lock); -#endif // #if (BLE_42_SCAN_EN == TRUE) +#if ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) + osi_mutex_unlock(&btm_lock); +#endif // ((BLE_42_ADV_EN == TRUE) || (BLE_42_SCAN_EN == TRUE)) return rt; } - +#if (BLE_42_ADV_EN == TRUE) /******************************************************************************* ** ** Function btm_ble_start_slow_adv @@ -3708,7 +3558,6 @@ tBTM_STATUS btm_ble_set_random_addr(BD_ADDR random_bda) *******************************************************************************/ static void btm_ble_start_slow_adv (void) { -#if (BLE_42_ADV_EN == TRUE) tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var; if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) { @@ -3729,8 +3578,8 @@ static void btm_ble_start_slow_adv (void) p_cb->adv_chnl_map, p_cb->afp); btm_ble_start_adv(); } -#endif // #if (BLE_42_ADV_EN == TRUE) } +#endif // #if (BLE_42_ADV_EN == TRUE) /******************************************************************************* ** ** Function btm_ble_timeout @@ -3748,7 +3597,9 @@ void btm_ble_timeout(TIMER_LIST_ENT *p_tle) case BTU_TTYPE_BLE_OBSERVE: break; case BTU_TTYPE_BLE_SCAN: +#if (BLE_42_SCAN_EN == TRUE) btm_ble_stop_discover(); +#endif break; case BTU_TTYPE_BLE_INQUIRY: break; @@ -3771,8 +3622,10 @@ void btm_ble_timeout(TIMER_LIST_ENT *p_tle) break; case BTU_TTYPE_BLE_GAP_FAST_ADV: +#if (BLE_42_ADV_EN == TRUE) /* fast adv is completed, fall back to slow adv interval */ btm_ble_start_slow_adv(); +#endif break; default: @@ -4203,74 +4056,66 @@ BOOLEAN BTM_Ble_Authorization(BD_ADDR bd_addr, BOOLEAN authorize) ** Parameter p_clear_adv_cback - Command complete callback ** *******************************************************************************/ -BOOLEAN BTM_BleClearAdv(tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback) +BOOLEAN BTM_BleClearAdv(void) { - tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb; - if (btsnd_hcic_ble_clear_adv() == FALSE) { BTM_TRACE_ERROR("%s: Unable to Clear Advertising", __FUNCTION__); return FALSE; } - p_cb->inq_var.p_clear_adv_cb = p_clear_adv_cback; return TRUE; } -BOOLEAN BTM_BleSetCsaSupport(UINT8 csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK *p_callback) +BOOLEAN BTM_BleSetCsaSupport(UINT8 csa_select) { if (btsnd_hcic_ble_set_csa_support(csa_select) != TRUE) { BTM_TRACE_ERROR("LE SetCsaSupport csa_select=%d: error", csa_select); return FALSE; } - btm_cb.ble_ctr_cb.set_csa_support_cmpl_cb = p_callback; return TRUE; } -BOOLEAN BTM_BleSetVendorEventMask(UINT32 evt_mask, tBTM_SET_VENDOR_EVT_MASK_CBACK *p_callback) +BOOLEAN BTM_BleSetVendorEventMask(UINT32 evt_mask) { if (btsnd_hcic_ble_set_vendor_evt_mask(evt_mask) != TRUE) { BTM_TRACE_ERROR("LE SetVendorEventMask evt_mask=%x: error", evt_mask); return FALSE; } - btm_cb.ble_ctr_cb.set_vendor_evt_mask_cmpl_cb = p_callback; return TRUE; } #endif // #if (BLE_VENDOR_HCI_EN == TRUE) -BOOLEAN BTM_BleSetRpaTimeout(uint16_t rpa_timeout,tBTM_SET_RPA_TIMEOUT_CMPL_CBACK *p_set_rpa_timeout_cback) +BOOLEAN BTM_BleSetRpaTimeout(uint16_t rpa_timeout) { if ((btsnd_hcic_ble_set_rand_priv_addr_timeout(rpa_timeout)) != TRUE) { BTM_TRACE_ERROR("Set RPA Timeout error, rpa_timeout:0x%04x",rpa_timeout); return FALSE; } - btm_cb.devcb.p_ble_set_rpa_timeout_cmpl_cb = p_set_rpa_timeout_cback; return TRUE; } BOOLEAN BTM_BleAddDevToResolvingList(BD_ADDR addr, uint8_t addr_type, - uint8_t irk[], - tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *p_add_dev_to_resolving_list_callback) + uint8_t irk[]) { UINT8 *local_irk = btm_cb.devcb.id_keys.irk; if ((btsnd_hcic_ble_add_device_resolving_list(addr_type, addr, irk, local_irk)) != TRUE) { BTM_TRACE_ERROR("Add device to resolving list error"); return FALSE; } - btm_cb.devcb.p_add_dev_to_resolving_list_cmpl_cb = p_add_dev_to_resolving_list_callback; + BTM_BleLegacyGapOneshotArm(BTM_BLE_LEGACY_GAP_ADD_DEV_TO_RPA_LIST_EVT); return TRUE; } -BOOLEAN BTM_BleSetPrivacyMode(UINT8 addr_type, BD_ADDR bd_addr, UINT8 privacy_mode, tBTM_SET_PRIVACY_MODE_CMPL_CBACK *p_callback) +BOOLEAN BTM_BleSetPrivacyMode(UINT8 addr_type, BD_ADDR bd_addr, UINT8 privacy_mode) { if (btsnd_hcic_ble_set_privacy_mode(addr_type, bd_addr, privacy_mode) != TRUE) { BTM_TRACE_ERROR("LE SetPrivacyMode Mode=%d: error", privacy_mode); return FALSE; } - btm_cb.devcb.p_set_privacy_mode_cmpl_cb = p_callback; return TRUE; } diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c b/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c index f0aa7ca56c6..947c920bffc 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_iso.c @@ -46,7 +46,7 @@ void btm_ble_iso_read_iso_tx_sync_complete(UINT8 *p) if (cb_params.btm_read_tx_sync.status != HCI_SUCCESS) { cb_params.btm_read_tx_sync.status = (BTM_HCI_ERROR | cb_params.btm_read_tx_sync.status); } - cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0xEFF); + cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0x0FFF); cb_params.btm_read_tx_sync.time_offset = (cb_params.btm_read_tx_sync.time_offset & 0xFFFFFF); BTM_TRACE_DEBUG("read tx sync cmpl, status 0x%x conn_hdl 0x%x pkt_seq_num %d tx_time_stamp %ld time_offset %ld\n", cb_params.btm_read_tx_sync.status, cb_params.btm_read_tx_sync.conn_hdl, cb_params.btm_read_tx_sync.pkt_seq_num, @@ -162,7 +162,7 @@ void btm_ble_cis_request_evt(tBTM_BLE_CIS_REQUEST_CMPL *params) } #endif // #if (BLE_FEAT_ISO_CIG_PERIPHERAL_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void btm_ble_big_create_cmpl_evt(tBTM_BLE_BIG_CREATE_CMPL *params) { BTM_TRACE_DEBUG("%s", __func__); @@ -217,7 +217,7 @@ void btm_ble_big_terminate_cmpl_evt(tBTM_BLE_BIG_TERMINATE_CMPL *params) BTM_IsoBleCallbackTrigger(BTM_BLE_ISO_BIG_TERMINATE_COMPLETE_EVT, &cb_params); } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) void btm_ble_big_sync_estab_evt(tBTM_BLE_BIG_SYNC_ESTAB_CMPL *params) @@ -315,7 +315,7 @@ void btm_ble_iso_data_path_update_complete(UINT16 opcode, UINT8 hci_status, UINT BTM_IsoBleCallbackTrigger(BTM_BLE_ISO_DATA_PATH_UPFATE_EVT, &cb_params); } -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) tBTM_STATUS BTM_BleBigCreate(uint8_t big_handle, uint8_t adv_handle, uint8_t num_bis, uint32_t sdu_interval, uint16_t max_sdu, uint16_t max_transport_latency, uint8_t rtn, uint8_t phy, uint8_t packing, uint8_t framing, @@ -356,23 +356,11 @@ tBTM_STATUS BTM_BleBigCreateTest(uint8_t big_handle, uint8_t adv_handle, uint8_t tBTM_STATUS BTM_BleBigTerminate(UINT8 big_handle, UINT8 reason) { - tHCI_STATUS err = HCI_SUCCESS; - tBTM_STATUS status = BTM_SUCCESS; - tBTM_BLE_ISO_CB_PARAMS cb_params = {0}; - - if ((err = btsnd_hcic_ble_big_terminate(big_handle, reason)) != TRUE) { - BTM_TRACE_ERROR("LE PA SyncCancel, cmd err=0x%x", err); - status = BTM_HCI_ERROR | err; - } - - if (status != BTM_SUCCESS) { - cb_params.status = status; - BTM_IsoBleCallbackTrigger(BTM_BLE_ISO_BIG_TERMINATE_COMPLETE_EVT, &cb_params); - } - - return status; + // event will be triggered in command status and complete event + btsnd_hcic_ble_big_terminate(big_handle, reason); + return BTM_SUCCESS; } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) tBTM_STATUS BTM_BleBigSyncCreate(uint8_t big_handle, uint16_t sync_handle, @@ -488,6 +476,11 @@ tBTM_STATUS BTM_BleSetCigParams(uint8_t cig_id, uint32_t sdu_int_c_to_p, uint32_ BTM_TRACE_ERROR("%s, cis_cnt %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_cnt, BLE_ISO_CIS_MAX_COUNT); return BTM_ILLEGAL_VALUE; } + // HCI_LE_Set_CIG_Parameters param length = 15 + 9*cis_cnt (UINT8). Max 255 => cis_cnt <= 26. + if (cis_cnt > 26) { + BTM_TRACE_ERROR("%s, cis_cnt %d exceeds HCI transport limit", __func__, cis_cnt); + return BTM_ILLEGAL_VALUE; + } if ((err = btsnd_hcic_ble_iso_set_cig_params(cig_id, sdu_int_c_to_p, sdu_int_p_to_c, worse_case_SCA, packing, framing, mtl_c_to_p, mtl_p_to_c, cis_cnt, (struct ble_hci_le_cis_params *)cis_params)) != HCI_SUCCESS) { @@ -508,6 +501,11 @@ tBTM_STATUS BTM_BleSetCigParamsTest(uint8_t cig_id, uint32_t sdu_int_c_to_p, uin BTM_TRACE_ERROR("%s, cis_cnt %d exceeds BLE_ISO_CIS_MAX_COUNT %d", __func__, cis_cnt, BLE_ISO_CIS_MAX_COUNT); return BTM_ILLEGAL_VALUE; } + // HCI_LE_Set_CIG_Parameters_Test param length = 15 + 14*cis_cnt (UINT8). Max 255 => cis_cnt <= 17. + if (cis_cnt > 17) { + BTM_TRACE_ERROR("%s, cis_cnt %d exceeds HCI transport limit", __func__, cis_cnt); + return BTM_ILLEGAL_VALUE; + } if ((err = btsnd_hcic_ble_iso_set_cig_params_test(cig_id, sdu_int_c_to_p, sdu_int_p_to_c,ft_c_to_p, ft_p_to_c, iso_interval, worse_case_SCA, packing, framing, cis_cnt, (struct ble_hci_le_cis_params_test *)cis_params)) != HCI_SUCCESS) { @@ -562,8 +560,14 @@ void btm_ble_accept_cis_req_cmd_status(tBTM_BLE_ISO_CB_PARAMS *cb_params) tBTM_STATUS BTM_BleAcceptCisReq(uint16_t cis_handle) { - btsnd_hcic_ble_iso_accept_cis_req(cis_handle); - return BTM_SUCCESS; + if (btsnd_hcic_ble_iso_accept_cis_req(cis_handle)) { + return BTM_SUCCESS; + } + // failed to send command + tBTM_BLE_ISO_CB_PARAMS cb_params = {0}; + cb_params.status = BTM_NO_RESOURCES; + btm_ble_accept_cis_req_cmd_status(&cb_params); + return BTM_NO_RESOURCES; } tBTM_STATUS BTM_BleRejectCisReq(uint16_t cis_handle, uint8_t reason) diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c index 633d15e2536..45f3af5bcd3 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c @@ -32,6 +32,7 @@ #include "btm_int.h" #include "device/controller.h" #include "stack/hcidefs.h" +#include "bta_dm_gap.h" #define HCI_VENDOR_BLE_RPA_VSC (0x0155 | HCI_GRP_VENDOR_SPECIFIC) @@ -49,6 +50,7 @@ #define BTM_BLE_META_CLEAR_IRK_LEN 1 #define BTM_BLE_META_READ_IRK_LEN 2 #define BTM_BLE_META_ADD_WL_ATTR_LEN 9 +#define BTM_BLE_IRK_LIST_INVALID_INDEX 0xFF #if CONTROLLER_RPA_LIST_ENABLE && BLE_SMP_ID_RESET_ENABLE static bool is_deleting_zero_addr; @@ -71,7 +73,14 @@ static bool is_deleting_zero_addr; void btm_ble_enq_resolving_list_pending(BD_ADDR pseudo_bda, UINT8 op_code) { tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q; - + UINT8 max_size = controller_get_interface()->get_ble_resolving_list_max_size(); + if (max_size <= 1) { + return; + } + if (((p_q->q_next + 1) % max_size) == p_q->q_pending) { + BTM_TRACE_ERROR("%s, resolving pending queue full\n", __func__); + return; + } memcpy(p_q->resolve_q_random_pseudo[p_q->q_next], pseudo_bda, BD_ADDR_LEN); p_q->resolve_q_action[p_q->q_next] = op_code; p_q->q_next ++; @@ -159,7 +168,7 @@ void btm_ble_clear_irk_index(UINT8 index) ** ** Description find the first available IRK list index ** -** Returns index from 0 ~ max (127 default) +** Returns index from 0 ~ max-1, or BTM_BLE_IRK_LIST_INVALID_INDEX if full ** *******************************************************************************/ UINT8 btm_ble_find_irk_index(void) @@ -180,7 +189,7 @@ UINT8 btm_ble_find_irk_index(void) } BTM_TRACE_ERROR ("%s failed, list full", __func__); - return i; + return BTM_BLE_IRK_LIST_INVALID_INDEX; } /******************************************************************************* @@ -202,7 +211,13 @@ void btm_ble_update_resolving_list(BD_ADDR pseudo_bda, BOOLEAN add) if (add) { p_dev_rec->ble.in_controller_list |= BTM_RESOLVING_LIST_BIT; if (!controller_get_interface()->supports_ble_privacy()) { - p_dev_rec->ble.resolving_list_index = btm_ble_find_irk_index(); + UINT8 irk_index = btm_ble_find_irk_index(); + if (irk_index != BTM_BLE_IRK_LIST_INVALID_INDEX) { + p_dev_rec->ble.resolving_list_index = irk_index; + } else { + p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT; + BTM_TRACE_WARNING("%s: IRK list full, cannot add to resolving list", __func__); + } } } else { p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT; @@ -244,10 +259,11 @@ void btm_ble_clear_resolving_list_complete(UINT8 *p, UINT16 evt_len) if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) { btm_ble_resolving_list_init(irk_list_sz_max); } - - uint8_t irk_mask_size = (irk_list_sz_max % 8) ? + if (btm_cb.ble_ctr_cb.irk_list_mask != NULL) { + uint8_t irk_mask_size = (irk_list_sz_max % 8) ? (irk_list_sz_max / 8 + 1) : (irk_list_sz_max / 8); - memset(btm_cb.ble_ctr_cb.irk_list_mask, 0, irk_mask_size); + memset(btm_cb.ble_ctr_cb.irk_list_mask, 0, irk_mask_size); + } } btm_cb.ble_ctr_cb.resolving_list_avail_size = @@ -279,14 +295,10 @@ void btm_ble_add_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len) { UINT8 status; STREAM_TO_UINT8(status, p); - if (btm_cb.devcb.p_add_dev_to_resolving_list_cmpl_cb) { - tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *p_cb = btm_cb.devcb.p_add_dev_to_resolving_list_cmpl_cb; - if (p_cb) { - (*p_cb)(status); - } - } else { - BTM_TRACE_DEBUG("no resolving list callback"); - } + + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_BleLegacyGapOneshotFireIfArmed(BTM_BLE_LEGACY_GAP_ADD_DEV_TO_RPA_LIST_EVT, &cb_params); BTM_TRACE_DEBUG("%s status = %d", __func__, status); @@ -424,21 +436,12 @@ void btm_ble_set_addr_resolution_enable_complete(UINT8 *p, UINT16 evt_len) BTM_TRACE_DEBUG("%s status = %d", __func__, status); - tBTM_LE_RANDOM_CB *random_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb; - - if (!(random_cb && random_cb->set_local_privacy_cback)) { - return; + if (status != HCI_SUCCESS) { + BTM_TRACE_ERROR("set local privacy failed with status: 0x%x", status); } - - if (status == HCI_SUCCESS) { - random_cb->set_local_privacy_cback(BTM_SUCCESS); - return; - } else if (status == HCI_ERR_COMMAND_DISALLOWED) { - BTM_TRACE_ERROR("a non-connected activity is ongoing, such as advertising and scanning"); - } else { - BTM_TRACE_ERROR("set local privacy failed"); - } - random_cb->set_local_privacy_cback(BTM_ILLEGAL_VALUE); + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = (status == HCI_SUCCESS)? BTM_SUCCESS : BTM_ILLEGAL_VALUE; + BTM_BleLegacyGapOneshotFireIfArmed(BTM_BLE_LEGACY_GAP_SET_PRIVACY_EVT, &cb_params); } /******************************************************************************* @@ -463,11 +466,9 @@ void btm_ble_set_rpa_timeout_complete(UINT8 *p, UINT16 evt_len) BTM_TRACE_DEBUG("%s status = %d", __func__, status); - tBTM_SET_RPA_TIMEOUT_CMPL_CBACK *p_cb = btm_cb.devcb.p_ble_set_rpa_timeout_cmpl_cb; - - if (p_cb) { - (*p_cb)(status); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_RPA_TIMEOUT_EVT, &cb_params); } @@ -492,11 +493,9 @@ void btm_ble_set_privacy_mode_complete(UINT8 *p, UINT16 evt_len) BTM_TRACE_DEBUG("%s status = 0x%x", __func__, status); - tBTM_SET_PRIVACY_MODE_CMPL_CBACK *p_cb = btm_cb.devcb.p_set_privacy_mode_cmpl_cb; - - if (p_cb) { - (*p_cb)(status); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_PRIVACY_MODE_COMPLETE_EVT, &cb_params); } #if (0) @@ -709,8 +708,9 @@ BOOLEAN btm_ble_suspend_resolving_list_activity(void) #if (BLE_42_ADV_EN == TRUE) if (p_ble_cb->inq_var.adv_mode == BTM_BLE_ADV_ENABLE) { - btm_ble_stop_adv(); - p_ble_cb->suspended_rl_state |= BTM_BLE_RL_ADV; + if (btm_ble_stop_adv() == BTM_SUCCESS) { + p_ble_cb->suspended_rl_state |= BTM_BLE_RL_ADV; + } } #endif // #if (BLE_42_ADV_EN == TRUE) @@ -1124,14 +1124,31 @@ void btm_ble_resolving_list_init(UINT8 max_irk_list_sz) tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q; UINT8 irk_mask_size = (max_irk_list_sz % 8) ? (max_irk_list_sz / 8 + 1) : (max_irk_list_sz / 8); + // free them if they are already allocated. + btm_ble_resolving_list_cleanup(); + + p_q->q_next = 0; + p_q->q_pending = 0; if (max_irk_list_sz > 0) { p_q->resolve_q_random_pseudo = (BD_ADDR *)osi_malloc(sizeof(BD_ADDR) * max_irk_list_sz); + if (p_q->resolve_q_random_pseudo == NULL) { + BTM_TRACE_ERROR("%s - Out of memory for random pseudo address", __FUNCTION__); + goto _mem_error; + } p_q->resolve_q_action = (UINT8 *)osi_malloc(max_irk_list_sz); + if (p_q->resolve_q_action == NULL) { + BTM_TRACE_ERROR("%s - Out of memory for resolve action", __FUNCTION__); + goto _mem_error; + } /* RPA offloading feature */ if (btm_cb.ble_ctr_cb.irk_list_mask == NULL) { btm_cb.ble_ctr_cb.irk_list_mask = (UINT8 *)osi_malloc(irk_mask_size); + if (btm_cb.ble_ctr_cb.irk_list_mask == NULL) { + BTM_TRACE_ERROR("%s - Out of memory for IRK list mask", __FUNCTION__); + goto _mem_error; + } } BTM_TRACE_DEBUG ("%s max_irk_list_sz = %d", __func__, max_irk_list_sz); @@ -1140,6 +1157,12 @@ void btm_ble_resolving_list_init(UINT8 max_irk_list_sz) controller_get_interface()->set_ble_resolving_list_max_size(max_irk_list_sz); btm_ble_clear_resolving_list(); btm_cb.ble_ctr_cb.resolving_list_avail_size = max_irk_list_sz; + + return; + +_mem_error: + btm_ble_resolving_list_cleanup(); + btm_cb.ble_ctr_cb.resolving_list_avail_size = 0; } /******************************************************************************* diff --git a/components/bt/host/bluedroid/stack/btm/btm_devctl.c b/components/bt/host/bluedroid/stack/btm/btm_devctl.c index 057eba2dbbc..1cc41f7e688 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_devctl.c +++ b/components/bt/host/bluedroid/stack/btm/btm_devctl.c @@ -42,6 +42,7 @@ #if BLE_INCLUDED == TRUE #include "gatt_int.h" #endif /* BLE_INCLUDED */ +#include "bta_dm_gap.h" //extern thread_t *bt_workqueue_thread; @@ -769,7 +770,6 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len, tBTM_CMPL_CB *p_vsc_cplt_cback) { #if (BLE_INCLUDED == TRUE) - tBTM_BLE_CB *ble_cb = &btm_cb.ble_ctr_cb; switch(opcode) { case HCI_VENDOR_BLE_UPDATE_DUPLICATE_EXCEPTIONAL_LIST: { #if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) @@ -777,34 +777,38 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len, STREAM_TO_UINT8(status, p); STREAM_TO_UINT8(subcode, p); STREAM_TO_UINT32(length, p); - if(ble_cb && ble_cb->update_exceptional_list_cmp_cb) { - (*ble_cb->update_exceptional_list_cmp_cb)(status, subcode, length, p); - } - break; + + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.exception_list_up.status = status; + cb_params.exception_list_up.subcode = subcode; + cb_params.exception_list_up.length = length; + cb_params.exception_list_up.device_info = p; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_EXCEPTION_LIST_UPDATE_EVT, &cb_params); #endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) + break; } case HCI_VENDOR_BLE_CLEAR_ADV: { uint8_t status; STREAM_TO_UINT8(status, p); - if (ble_cb && ble_cb->inq_var.p_clear_adv_cb) { - ble_cb->inq_var.p_clear_adv_cb(status); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_CLEAR_ADV_COMPLETE_EVT, &cb_params); break; } case HCI_VENDOR_BLE_SET_CSA_SUPPORT: { uint8_t status; STREAM_TO_UINT8(status, p); - if (ble_cb && ble_cb->set_csa_support_cmpl_cb) { - ble_cb->set_csa_support_cmpl_cb(status); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_CSA_SUPPORT_COMPLETE_EVT, &cb_params); break; } case HCI_VENDOR_BLE_SET_EVT_MASK: { uint8_t status; STREAM_TO_UINT8(status, p); - if (ble_cb && ble_cb->set_vendor_evt_mask_cmpl_cb) { - ble_cb->set_vendor_evt_mask_cmpl_cb(status); - } + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.status = status; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_VENDOR_EVT_MASK_COMPLETE_EVT, &cb_params); break; } default: @@ -1286,20 +1290,12 @@ void btm_set_afh_channels_complete (UINT8 *p) ** Returns status of the operation ** *******************************************************************************/ -tBTM_STATUS BTM_BleSetChannels (BLE_CHANNELS channels, tBTM_CMPL_CB *p_ble_channels_cmpl_cback) +tBTM_STATUS BTM_BleSetChannels (BLE_CHANNELS channels) { if (!controller_get_interface()->get_is_ready()) { return (BTM_DEV_RESET); } - /* Check if set afh already in progress */ - if (btm_cb.devcb.p_ble_channels_cmpl_cb) { - return (BTM_NO_RESOURCES); - } - - /* Save callback */ - btm_cb.devcb.p_ble_channels_cmpl_cb = p_ble_channels_cmpl_cback; - if (!btsnd_hcic_ble_set_channels (channels)) { return (BTM_NO_RESOURCES); } @@ -1321,30 +1317,24 @@ tBTM_STATUS BTM_BleSetChannels (BLE_CHANNELS channels, tBTM_CMPL_CB *p_ble_chann *******************************************************************************/ void btm_ble_set_channels_complete (UINT8 *p) { - tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_ble_channels_cmpl_cb; - tBTM_BLE_SET_CHANNELS_RESULTS results; + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; btu_free_timer (&btm_cb.devcb.ble_channels_timer); - /* If there is a callback address for setting AFH channels, call it */ - btm_cb.devcb.p_ble_channels_cmpl_cb = NULL; + STREAM_TO_UINT8 (cb_params.set_channels.hci_status, p); - if (p_cb) { - STREAM_TO_UINT8 (results.hci_status, p); - - switch (results.hci_status){ - case HCI_SUCCESS: - results.status = BTM_SUCCESS; - break; - case HCI_ERR_UNSUPPORTED_VALUE: - case HCI_ERR_ILLEGAL_PARAMETER_FMT: - results.status = BTM_ILLEGAL_VALUE; - break; - default: - results.status = BTM_ERR_PROCESSING; - break; - } - (*p_cb)(&results); + switch (cb_params.set_channels.hci_status){ + case HCI_SUCCESS: + cb_params.set_channels.status = BTM_SUCCESS; + break; + case HCI_ERR_UNSUPPORTED_VALUE: + case HCI_ERR_ILLEGAL_PARAMETER_FMT: + cb_params.set_channels.status = BTM_ILLEGAL_VALUE; + break; + default: + cb_params.set_channels.status = BTM_ERR_PROCESSING; + break; } + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_SET_CHANNELS_COMPLETE_EVT, &cb_params); } #endif /// BLE_INCLUDED == TRUE diff --git a/components/bt/host/bluedroid/stack/btm/btm_main.c b/components/bt/host/bluedroid/stack/btm/btm_main.c index 55430477869..5392ac4b557 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_main.c +++ b/components/bt/host/bluedroid/stack/btm/btm_main.c @@ -88,7 +88,6 @@ void btm_init (void) btm_dev_init(); /* Device Manager Structures & HCI_Reset */ #if BLE_INCLUDED == TRUE btm_ble_lock_init(); - btm_ble_sem_init(); #if ((SMP_INCLUDED == TRUE) || (BLE_PRIVACY_SPT == TRUE)) btm_cb.addr_res_en = TRUE; #endif // ((SMP_INCLUDED == TRUE) || (BLE_PRIVACY_SPT == TRUE)) @@ -131,7 +130,6 @@ void btm_free(void) #endif #if BLE_INCLUDED == TRUE btm_ble_lock_free(); - btm_ble_sem_free(); #endif } diff --git a/components/bt/host/bluedroid/stack/btm/btm_sco.c b/components/bt/host/bluedroid/stack/btm/btm_sco.c index 6964028000d..a9a2d76f46f 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_sco.c +++ b/components/bt/host/bluedroid/stack/btm/btm_sco.c @@ -322,7 +322,7 @@ void btm_sco_check_send_pkts (UINT16 sco_inx) } } -void btm_sco_process_num_completed_pkts (UINT8 *p) +void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len) { UINT8 num_handles, xx; UINT16 handle; @@ -330,7 +330,20 @@ void btm_sco_process_num_completed_pkts (UINT8 *p) UINT16 sco_inx; tSCO_CB *p_cb = &btm_cb.sco_cb; tSCO_CONN * p_ccb; + + if (evt_len < 1) { + BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: evt too short (len=%u)", evt_len); + return; + } + STREAM_TO_UINT8 (num_handles, p); + + if (num_handles > (evt_len - 1) / 4) { + BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: num_handles %u exceeds evt_len %u, truncating", + num_handles, evt_len); + num_handles = (evt_len - 1) / 4; + } + for (xx = 0; xx < num_handles; xx++) { STREAM_TO_UINT16 (handle, p); STREAM_TO_UINT16 (num_sent, p); diff --git a/components/bt/host/bluedroid/stack/btm/btm_sec.c b/components/bt/host/bluedroid/stack/btm/btm_sec.c index 4dcfaffe523..a744bc30322 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_sec.c +++ b/components/bt/host/bluedroid/stack/btm/btm_sec.c @@ -3491,6 +3491,12 @@ void btm_io_capabilities_rsp (UINT8 *p) /* Allocate a new device record or reuse the oldest one */ p_dev_rec = btm_find_or_alloc_dev (evt_data.bd_addr); + if (p_dev_rec == NULL) { + BTM_TRACE_ERROR ("%s: no device record available\n", __FUNCTION__); + return; + } + + /* If no security is in progress, this indicates incoming security */ if (btm_cb.pairing_state == BTM_PAIR_STATE_IDLE) { memcpy (btm_cb.pairing_bda, evt_data.bd_addr, BD_ADDR_LEN); @@ -4337,6 +4343,16 @@ void btm_sec_connected (UINT8 *bda, UINT16 handle, UINT8 status, UINT8 enc_mode) /* There is no device record for new connection. Allocate one */ if (status == HCI_SUCCESS) { p_dev_rec = btm_sec_alloc_dev (bda); + // no memory to allocate device record + if (p_dev_rec == NULL) { + if ((btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) && + (memcmp (btm_cb.pairing_bda, bda, BD_ADDR_LEN) == 0)) { + btm_sec_change_pairing_state(BTM_PAIR_STATE_IDLE); + } + BTM_TRACE_ERROR ("%s: no device record available\n", __FUNCTION__); + return; + } + } else { /* If the device matches with stored paring address * reset the paring state to idle */ @@ -4899,6 +4915,12 @@ void btm_sec_link_key_notification (UINT8 *p_bda, UINT8 *p_link_key, UINT8 key_t void btm_sec_link_key_request (UINT8 *p_bda) { tBTM_SEC_DEV_REC *p_dev_rec = btm_find_or_alloc_dev (p_bda); + // no memory to allocate device record + if (p_dev_rec == NULL) { + btsnd_hcic_link_key_neg_reply (p_bda); + BTM_TRACE_ERROR ("%s: no device record available\n", __FUNCTION__); + return; + } BTM_TRACE_EVENT ("btm_sec_link_key_request() BDA: %02x:%02x:%02x:%02x:%02x:%02x\n", p_bda[0], p_bda[1], p_bda[2], p_bda[3], p_bda[4], p_bda[5]); @@ -6011,13 +6033,22 @@ static BOOLEAN btm_sec_queue_encrypt_request (BD_ADDR bd_addr, tBT_TRANSPORT tra tBTM_SEC_CALLBACK *p_callback, void *p_ref_data) { tBTM_SEC_QUEUE_ENTRY *p_e; + if (bd_addr == NULL) { + BTM_TRACE_ERROR("%s: bd_addr is NULL\n", __func__); + return FALSE; + } + p_e = (tBTM_SEC_QUEUE_ENTRY *)osi_malloc(sizeof(tBTM_SEC_QUEUE_ENTRY) + 1); if (p_e) { p_e->psm = 0; /* if PSM 0, encryption request */ p_e->p_callback = p_callback; - p_e->p_ref_data = (void *)(p_e + 1); - *(UINT8 *)p_e->p_ref_data = *(UINT8 *)(p_ref_data); + if (p_ref_data != NULL) { + p_e->p_ref_data = (void *)(p_e + 1); + *(UINT8 *)p_e->p_ref_data = *(UINT8 *)p_ref_data; + } else { + p_e->p_ref_data = NULL; + } p_e->transport = transport; memcpy(p_e->bd_addr, bd_addr, BD_ADDR_LEN); fixed_queue_enqueue(btm_cb.sec_pending_q, p_e, FIXED_QUEUE_MAX_TIMEOUT); @@ -6256,36 +6287,6 @@ BOOLEAN btm_sec_is_le_capable_dev (BD_ADDR bda) return le_capable; } -/******************************************************************************* -** -** Function btm_sec_find_bonded_dev -** -** Description Find a bonded device starting from the specified index -** -** Returns TRUE - found a bonded device -** -*******************************************************************************/ -#if (BLE_INCLUDED == TRUE) -BOOLEAN btm_sec_find_bonded_dev (UINT8 start_idx, UINT16 *p_found_handle, tBTM_SEC_DEV_REC **p_rec) -{ - BOOLEAN found = FALSE; - -#if (SMP_INCLUDED== TRUE) - tBTM_SEC_DEV_REC *p_dev_rec; - list_node_t *p_node = NULL; - for (p_node = list_begin(btm_cb.p_sec_dev_rec_list); p_node; p_node = list_next(p_node)) { - p_dev_rec = list_node(p_node); - if (p_dev_rec->ble.key_type || (p_dev_rec->sec_flags & BTM_SEC_LINK_KEY_KNOWN)) { - *p_found_handle = p_dev_rec->hci_handle; - *p_rec = p_dev_rec; - break; - } - } - BTM_TRACE_DEBUG ("%s() found=%d\n", __func__, found); -#endif - return (found); -} -#endif ///BLE_INCLUDED == TRUE /******************************************************************************* ** ** Function btm_sec_use_smp_br_chnl diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h index d91f9927f6d..02fa86b47e2 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h @@ -157,9 +157,6 @@ typedef struct { UINT16 adv_interval_max; tBTM_BLE_AFP afp; /* advertising filter policy */ tBTM_BLE_SFP sfp; /* scanning filter policy */ - tBTM_START_ADV_CMPL_CBACK *p_adv_cb; - tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cb; - tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cb; tBLE_ADDR_TYPE adv_addr_type; UINT8 evt_type; UINT8 adv_mode; @@ -206,7 +203,6 @@ typedef struct { tBTM_BLE_ADDR_CBACK *p_generate_cback; void *p; TIMER_LIST_ENT raddr_timer_ent; - tBTM_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback; } tBTM_LE_RANDOM_CB; #define BTM_BLE_MAX_BG_CONN_DEV_NUM 10 @@ -358,7 +354,6 @@ typedef struct { /* periodic list information */ UINT8 periodic_adv_list_size; #endif //#if (BLE_50_EXTEND_SYNC_EN == TRUE) - tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb; tBTM_BLE_WL_STATE wl_state; fixed_queue_t *conn_pending_q; @@ -386,13 +381,6 @@ typedef struct { tBTM_BLE_STATE_MASK cur_states; /* bit mask of tBTM_BLE_STATE */ UINT8 link_count[2]; /* total link count master and slave*/ #endif // (BLE_TOPOLOGY_CHECK == TRUE) -#if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) - tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK *update_exceptional_list_cmp_cb; -#endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE)) -#if (BLE_VENDOR_HCI_EN == TRUE) - tBTM_SET_CSA_SUPPORT_CMPL_CBACK *set_csa_support_cmpl_cb; - tBTM_SET_VENDOR_EVT_MASK_CBACK *set_vendor_evt_mask_cmpl_cb; -#endif // (BLE_VENDOR_HCI_EN == TRUE) } tBTM_BLE_CB; #ifdef __cplusplus @@ -401,7 +389,7 @@ extern "C" { void btm_ble_timeout(TIMER_LIST_ENT *p_tle); #if (BLE_42_SCAN_EN == TRUE) -void btm_ble_process_adv_pkt (UINT8 *p); +void btm_ble_process_adv_pkt (UINT8 *p, UINT8 evt_len); void btm_ble_process_adv_discard_evt(UINT8 *p); void btm_ble_process_direct_adv_pkt (UINT8 *p); bool btm_ble_adv_pkt_ready(void); @@ -464,10 +452,10 @@ void btm_ble_update_sec_key_size(BD_ADDR bd_addr, UINT8 enc_key_size); UINT8 btm_ble_read_sec_key_size(BD_ADDR bd_addr); /* white list function */ -BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb); +BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type); void btm_update_scanner_filter_policy(tBTM_BLE_SFP scan_policy); void btm_update_adv_filter_policy(tBTM_BLE_AFP adv_policy); -void btm_ble_clear_white_list (tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb); +void btm_ble_clear_white_list (void); void btm_read_white_list_size_complete(UINT8 *p, UINT16 evt_len); void btm_ble_add_2_white_list_complete(UINT8 status); void btm_ble_remove_from_white_list_complete(UINT8 *p, UINT16 evt_len); @@ -578,10 +566,10 @@ void btm_ble_accept_cis_req_cmd_status(tBTM_BLE_ISO_CB_PARAMS *cb_params); void btm_ble_create_cis_cmd_status(tBTM_BLE_ISO_CB_PARAMS *cb_params); void btm_ble_iso_set_cig_params_complete(UINT8 *p); #endif // #if (BLE_FEAT_ISO_CIG_CENTRAL_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void btm_ble_big_create_cmpl_evt(tBTM_BLE_BIG_CREATE_CMPL *param); void btm_ble_big_terminate_cmpl_evt(tBTM_BLE_BIG_TERMINATE_CMPL *params); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) void btm_ble_big_sync_estab_evt(tBTM_BLE_BIG_SYNC_ESTAB_CMPL *params); void btm_ble_big_sync_lost_evt(tBTM_BLE_BIG_SYNC_LOST_EVT *params); diff --git a/components/bt/host/bluedroid/stack/btm/include/btm_int.h b/components/bt/host/bluedroid/stack/btm/include/btm_int.h index 2f1ae394140..c0a1e2f2e24 100644 --- a/components/bt/host/bluedroid/stack/btm/include/btm_int.h +++ b/components/bt/host/bluedroid/stack/btm/include/btm_int.h @@ -158,12 +158,10 @@ UINT8 conn_addr_type; /* local device address type for this co BD_ADDR active_remote_addr; /* remote address used on this connection */ UINT8 active_remote_addr_type; /* local device address type for this connection */ BD_FEATURES peer_le_features; /* Peer LE Used features mask for the device */ -tBTM_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback; tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS data_length_params; BOOLEAN data_len_updating; // data len update cmd cache BOOLEAN data_len_waiting; -tBTM_SET_PKT_DATA_LENGTH_CBACK *p_set_data_len_cback_waiting; UINT16 tx_len_waiting; #endif tBTM_PM_MCB *p_pm_mode_db; /* Pointer to PM mode control block per ACL link */ @@ -241,7 +239,7 @@ tBTM_CMPL_CB *p_write_iscan_tx_pwr_lvl_cmpl_cb; /* Callback function t #endif // (CLASSIC_BT_INCLUDED == TRUE) #if BLE_INCLUDED == TRUE -tBTM_CMPL_CB *p_ble_ch_map_cmpl_cb; /* Callback function to be called when */ +BOOLEAN is_ch_map_cb; #endif // #if BLE_INCLUDED == TRUE /* read channel map function completes */ #if (CLASSIC_BT_INCLUDED == TRUE) @@ -292,15 +290,6 @@ DEV_CLASS dev_class; /* Local device class #if BLE_INCLUDED == TRUE TIMER_LIST_ENT ble_channels_timer; -tBTM_CMPL_CB *p_ble_channels_cmpl_cb; /* Callback function to be called When - ble set host channels is completed */ - -tBTM_SET_RPA_TIMEOUT_CMPL_CBACK *p_ble_set_rpa_timeout_cmpl_cb; /* Callback function to be called When - ble set rpa timeout is completed */ - -tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *p_add_dev_to_resolving_list_cmpl_cb; - -tBTM_SET_PRIVACY_MODE_CMPL_CBACK *p_set_privacy_mode_cmpl_cb; tBTM_CMPL_CB *p_le_test_cmd_cmpl_cb; /* Callback function to be called when LE test mode command has been sent successfully */ @@ -1053,14 +1042,6 @@ typedef struct { #endif } tBTM_CB; -typedef struct{ - //connection parameters update callback - tBTM_UPDATE_CONN_PARAM_CBACK *update_conn_param_cb; - // setting packet data length callback - tBTM_SET_PKT_DATA_LENGTH_CBACK *set_pkt_data_length_cb; -}tBTM_CallbackFunc; - -extern tBTM_CallbackFunc conn_callback_func; /* security action for L2CAP COC channels */ #define BTM_SEC_OK 1 #define BTM_SEC_ENCRYPT 2 /* encrypt the link with current key */ @@ -1192,7 +1173,7 @@ void btm_pm_proc_ssr_evt (UINT8 *p, UINT16 evt_len); void btm_sco_chk_pend_unpark (UINT8 hci_status, UINT16 hci_handle); #if (BTM_SCO_HCI_INCLUDED == TRUE ) void btm_sco_process_num_bufs (UINT16 num_lm_sco_bufs); -void btm_sco_process_num_completed_pkts (UINT8 *p); +void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len); #endif /* (BTM_SCO_HCI_INCLUDED == TRUE ) */ #else #define btm_sco_chk_pend_unpark(hci_status, hci_handle) @@ -1337,7 +1318,6 @@ void btm_sec_set_peer_sec_caps (tACL_CONN *p_acl_cb, tBTM_SEC_DEV_REC *p_dev_rec #if BLE_INCLUDED == TRUE void btm_sec_clear_ble_keys (tBTM_SEC_DEV_REC *p_dev_rec); -BOOLEAN btm_sec_find_bonded_dev (UINT8 start_idx, UINT16 *p_found_handle, tBTM_SEC_DEV_REC **p_rec); BOOLEAN btm_sec_is_a_bonded_dev (BD_ADDR bda); void btm_consolidate_dev(tBTM_SEC_DEV_REC *p_target_rec); BOOLEAN btm_sec_is_le_capable_dev (BD_ADDR bda); @@ -1366,10 +1346,6 @@ void btm_sec_clr_temp_auth_service (BD_ADDR bda); void btm_ble_lock_init(void); -void btm_ble_sem_init(void); - -void btm_ble_sem_free(void); - void btm_ble_lock_free(void); void btm_sec_handle_remote_legacy_auth_cmp(UINT16 handle); diff --git a/components/bt/host/bluedroid/stack/btu/btu_hcif.c b/components/bt/host/bluedroid/stack/btu/btu_hcif.c index b561f25b15c..d780395f1c5 100644 --- a/components/bt/host/bluedroid/stack/btu/btu_hcif.c +++ b/components/bt/host/bluedroid/stack/btu/btu_hcif.c @@ -100,7 +100,7 @@ static void btu_hcif_hardware_error_evt (UINT8 *p); static void btu_hcif_flush_occured_evt (void); static void btu_hcif_role_change_evt (UINT8 *p); #endif // #if (CLASSIC_BT_INCLUDED == TRUE) -static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p); +static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p, UINT8 evt_len); #if (CLASSIC_BT_INCLUDED == TRUE) static void btu_hcif_mode_change_evt (UINT8 *p); @@ -195,16 +195,16 @@ static void btu_ble_periodic_adv_sync_trans_recv(UINT8 *p); #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void btu_ble_create_big_cmd_status(UINT8 status); -static void btu_ble_big_create_complete_evt(UINT8 *p); +static void btu_ble_big_create_complete_evt(UINT8 *p, UINT8 evt_len); void btu_ble_big_terminate_cmd_status(UINT8 status); static void btu_ble_big_terminate_complete_evt(UINT8 *p); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) static void btu_ble_create_big_sync_cmd_status(UINT8 status); -static void btu_ble_big_sync_establish_evt(UINT8 *p); +static void btu_ble_big_sync_establish_evt(UINT8 *p, UINT8 evt_len); static void btu_ble_big_sync_lost_evt(UINT8 *p); static void btu_ble_biginfo_adv_report_evt(UINT8 *p); #endif // #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) @@ -225,10 +225,10 @@ static void btu_ble_cis_disconnected(UINT16 handle, UINT8 reason); #if (BLE_FEAT_CTE_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) -static void btu_ble_cte_connless_iq_report_evt(UINT8 *p); +static void btu_ble_cte_connless_iq_report_evt(UINT8 *p, UINT8 evt_len); #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) -static void btu_ble_cte_conn_iq_report_evt(UINT8 *p); +static void btu_ble_cte_conn_iq_report_evt(UINT8 *p, UINT8 evt_len); static void btu_ble_cte_req_failed_evt(UINT8 *p); #endif // #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) #endif // #if (BLE_FEAT_CTE_EN == TRUE) @@ -244,7 +244,7 @@ static void btu_ble_subrate_change_evt(UINT8 *p); #if (BT_BLE_FEAT_PAWR_EN == TRUE) static void btu_ble_pa_subevt_data_request_evt(UINT8 *p); -static void btu_ble_pa_response_report_evt(UINT8 *p); +static void btu_ble_pa_response_report_evt(UINT8 *p, UINT8 evt_len); #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) #if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) @@ -253,24 +253,10 @@ static void btu_ble_cs_read_remote_fae_tab_evt(UINT8 *p); static void btu_ble_cs_security_enable_cmpl_evt(UINT8 *p); static void btu_ble_cs_config_cmpl_evt(UINT8 *p); static void btu_ble_cs_proc_enable_cmpl_evt(UINT8 *p); -static void btu_ble_cs_subevt_result_evt(UINT8 *p); -static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p); +static void btu_ble_cs_subevt_result_evt(UINT8 *p, UINT8 evt_len); +static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p, UINT8 evt_len); #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) -#if (BLE_42_ADV_EN == TRUE) -extern osi_sem_t adv_enable_sem; -extern osi_sem_t adv_data_sem; -extern osi_sem_t adv_param_sem; -extern uint8_t adv_enable_status; -extern uint8_t adv_data_status; -extern uint8_t adv_param_status; -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) -extern osi_sem_t scan_enable_sem; -extern osi_sem_t scan_param_sem; -extern uint8_t scan_enable_status; -extern uint8_t scan_param_status; -#endif // #if (BLE_42_SCAN_EN == TRUE) #endif /******************************************************************************* @@ -290,9 +276,20 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) #if BLE_INCLUDED == TRUE UINT8 ble_sub_code; #endif + if (p_msg->len < 2) { + HCI_TRACE_ERROR("%s: HCI event too short (len=%u), dropping", __func__, p_msg->len); + return; + } + STREAM_TO_UINT8 (hci_evt_code, p); STREAM_TO_UINT8 (hci_evt_len, p); + if (hci_evt_len > p_msg->len - 2) { + HCI_TRACE_ERROR("%s: HCI evt 0x%02x param len %u exceeds buffer (avail=%u), dropping", + __func__, hci_evt_code, hci_evt_len, p_msg->len - 2); + return; + } + switch (hci_evt_code) { #if (CLASSIC_BT_INCLUDED == TRUE) case HCI_INQUIRY_COMP_EVT: @@ -375,7 +372,7 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) break; #endif // #if (CLASSIC_BT_INCLUDED == TRUE) case HCI_NUM_COMPL_DATA_PKTS_EVT: - btu_hcif_num_compl_data_pkts_evt (p); + btu_hcif_num_compl_data_pkts_evt (p, hci_evt_len); break; #if (CLASSIC_BT_INCLUDED == TRUE) case HCI_MODE_CHANGE_EVT: @@ -472,6 +469,10 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) #if (BLE_INCLUDED == TRUE) case HCI_BLE_EVENT: + if (hci_evt_len < 1) { + HCI_TRACE_ERROR("%s: BLE meta event param len %u invalid (need >= 1), dropping", __func__, hci_evt_len); + break; + } STREAM_TO_UINT8 (ble_sub_code, p); hci_evt_len--; HCI_TRACE_DEBUG("BLE HCI(id=%d) event = 0x%02x)", hci_evt_code, ble_sub_code); @@ -578,17 +579,17 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) btu_ble_cis_request_evt(p); break; #endif // #if (BLE_FEAT_ISO_CIG_PERIPHERAL_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) case HCI_BLE_BIG_CREATE_COMPLETE_EVT: - btu_ble_big_create_complete_evt(p); + btu_ble_big_create_complete_evt(p, hci_evt_len); break; case HCI_BLE_BIG_TERMINATE_COMPLETE_EVT: btu_ble_big_terminate_complete_evt(p); break; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) case HCI_BLE_BIG_SYNC_ESTABLISHED_EVT: - btu_ble_big_sync_establish_evt(p); + btu_ble_big_sync_establish_evt(p, hci_evt_len); break; case HCI_BLE_BIG_SYNC_LOST_EVT: btu_ble_big_sync_lost_evt(p); @@ -601,13 +602,13 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) #if (BLE_FEAT_CTE_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) case HCI_BLE_CONNLESS_IQ_REPORT_EVT: - btu_ble_cte_connless_iq_report_evt(p); + btu_ble_cte_connless_iq_report_evt(p, hci_evt_len); break; #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) case HCI_BLE_CONN_IQ_REPORT_EVT: - btu_ble_cte_conn_iq_report_evt(p); + btu_ble_cte_conn_iq_report_evt(p, hci_evt_len); break; case HCI_BLE_CTE_REQUEST_FAILED_EVT: btu_ble_cte_req_failed_evt(p); @@ -633,7 +634,7 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) btu_ble_pa_subevt_data_request_evt(p); break; case HCI_BLE_PA_RESPONSE_REPORT_EVT: - btu_ble_pa_response_report_evt(p); + btu_ble_pa_response_report_evt(p, hci_evt_len); break; #endif // #if (BT_BLE_FEAT_PAWR_EN == TRUE) #if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) @@ -653,10 +654,10 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg) btu_ble_cs_proc_enable_cmpl_evt(p); break; case HCI_BLE_CS_SUBEVENT_RESULT_EVT: - btu_ble_cs_subevt_result_evt(p); + btu_ble_cs_subevt_result_evt(p, hci_evt_len); break; case HCI_BLE_CS_SUBEVENT_RESULT_CONTINUE_EVT: - btu_ble_cs_subevt_result_continue_evt(p); + btu_ble_cs_subevt_result_continue_evt(p, hci_evt_len); break; #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) } @@ -719,7 +720,7 @@ void btu_hcif_send_cmd (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_buf) #endif } -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) UINT8 btu_hcif_send_cmd_sync (UINT8 controller_id, BT_HDR *p_buf) { if (!p_buf) { @@ -770,8 +771,7 @@ UINT8 btu_hcif_send_cmd_sync (UINT8 controller_id, BT_HDR *p_buf) #endif return btsnd_hcic_ble_get_status(); } -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) - +#endif // ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) /******************************************************************************* ** @@ -1418,7 +1418,7 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l #if (BLE_FEAT_ISO_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) case HCI_BLE_BIG_TERMINATE_SYNC: - UINT16 big_handle; + UINT8 big_handle; STREAM_TO_UINT8(status, p); STREAM_TO_UINT8(big_handle, p); btm_ble_big_sync_terminate_complete(status, big_handle); @@ -1521,52 +1521,14 @@ static void btu_hcif_command_complete_evt_on_task(BT_HDR *event) static void btu_hcif_command_complete_evt(BT_HDR *response, void *context) { -#if (BLE_INCLUDED == TRUE) - command_opcode_t opcode; - uint8_t *stream = response->data + response->offset + 3; - STREAM_TO_UINT16(opcode, stream); - switch (opcode) { -#if (BLE_42_ADV_EN == TRUE) - case HCI_BLE_WRITE_ADV_DATA: - adv_data_status = *stream; - osi_sem_give(&adv_data_sem); - break; - case HCI_BLE_WRITE_SCAN_RSP_DATA: - adv_data_status = *stream; - osi_sem_give(&adv_data_sem); - break; - case HCI_BLE_WRITE_ADV_ENABLE: { - adv_enable_status = *stream; - osi_sem_give(&adv_enable_sem); - break; - } - case HCI_BLE_WRITE_ADV_PARAMS: - adv_param_status = *stream; - osi_sem_give(&adv_param_sem); - break; -#endif // #if (BLE_42_ADV_EN == TRUE) -#if (BLE_42_SCAN_EN == TRUE) - case HCI_BLE_WRITE_SCAN_PARAMS: - scan_param_status = *stream; - osi_sem_give(&scan_param_sem); - break; - case HCI_BLE_WRITE_SCAN_ENABLE: - scan_enable_status = *stream; - osi_sem_give(&scan_enable_sem); - break; -#endif // #if (BLE_42_SCAN_EN == TRUE) - default: - break; - } -#endif BT_HDR *event = osi_calloc(sizeof(BT_HDR) + sizeof(command_complete_hack_t)); command_complete_hack_t *hack = (command_complete_hack_t *)&event->data[0]; -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) UINT8 status = 0; - stream = response->data + response->offset + 3 + 2; // 2 to skip the event headers, 1 to skip the command credits, 2 to opcode. + uint8_t *stream = response->data + response->offset + 3 + 2; // 2 to skip the event headers, 1 to skip the command credits, 2 to opcode. STREAM_TO_UINT8(status, stream); btsnd_hci_ble_set_status(status); -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#endif // #if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) HCI_TRACE_DEBUG("btu_hcif_command_complete_evt\n"); hack->callback = btu_hcif_command_complete_evt_on_task; @@ -1649,7 +1611,7 @@ static void btu_hcif_hdl_command_status (UINT16 opcode, UINT8 status, UINT8 *p_c } #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) case HCI_BLE_CREATE_BIG: case HCI_BLE_CREATE_BIG_TEST: btu_ble_create_big_cmd_status(status); @@ -1657,7 +1619,7 @@ static void btu_hcif_hdl_command_status (UINT16 opcode, UINT8 status, UINT8 *p_c case HCI_BLE_TERMINATE_BIG: btu_ble_big_terminate_cmd_status(status); break; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) case HCI_BLE_BIG_CREATE_SYNC: btu_ble_create_big_sync_cmd_status(status); @@ -1948,14 +1910,14 @@ static void btu_hcif_role_change_evt (UINT8 *p) ** Returns void ** *******************************************************************************/ -static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p) +static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p, UINT8 evt_len) { /* Process for L2CAP and SCO */ - l2c_link_process_num_completed_pkts (p); + l2c_link_process_num_completed_pkts (p, evt_len); /* Send on to SCO */ #if (BTM_SCO_HCI_INCLUDED == TRUE) && (BTM_SCO_INCLUDED == TRUE) - btm_sco_process_num_completed_pkts (p); + btm_sco_process_num_completed_pkts (p, evt_len); #endif } #if (CLASSIC_BT_INCLUDED == TRUE) @@ -2553,9 +2515,9 @@ static void btm_ble_resolve_random_addr_adv_ext(void *p_rec, void *p) { tBTM_SEC_DEV_REC *match_rec = (tBTM_SEC_DEV_REC *) p_rec; BD_ADDR bda; - UINT8 *pp = (UINT8 *)p+4; //jump to the location of bd addr + UINT8 *pp = (UINT8 *)p+2; //jump to the location of addr_type if (match_rec) { - // Assign the original address to be the current report address + UINT8_TO_STREAM(pp, match_rec->ble.ble_addr_type); memcpy(bda, match_rec->ble.pseudo_addr, BD_ADDR_LEN); BDADDR_TO_STREAM(pp,bda); } @@ -2569,28 +2531,47 @@ static void btu_ble_ext_adv_report_evt(UINT8 *p, UINT16 evt_len) tBTM_BLE_EXT_ADV_REPORT ext_adv_report = {0}; UINT8 num_reports = {0}; #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) - UINT8 *pp = p; + UINT8 *pp; + BOOLEAN match = FALSE; #endif //UINT8 legacy_event_type = 0; UINT16 evt_type = 0; uint8_t addr_type; BD_ADDR bda; - #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) - BOOLEAN match = FALSE; - #endif + UINT16 remaining; if (!p) { HCI_TRACE_ERROR("%s, Invalid params.", __func__); return; } + if (evt_len < 1) { + HCI_TRACE_ERROR("%s, evt_len too short (%u)", __func__, evt_len); + return; + } + STREAM_TO_UINT8(num_reports, p); + remaining = evt_len - 1; if (num_reports == 0) { HCI_TRACE_ERROR("%s, Invalid number reports is 0", __func__); } + /* Per-report fixed fields: evt_type(2) + addr_type(1) + bda(6) + + * primary_phy(1) + secondary_phy(1) + sid(1) + tx_power(1) + rssi(1) + + * per_adv_interval(2) + dir_addr_type(1) + dir_addr(6) + adv_data_len(1) = 24 */ + #define EXT_ADV_RPT_FIXED_LEN 24 + while (num_reports--) { + if (remaining < EXT_ADV_RPT_FIXED_LEN) { + HCI_TRACE_ERROR("%s, remaining %u too short for report (need %u)", + __func__, remaining, EXT_ADV_RPT_FIXED_LEN); + return; + } +#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE) + /* Save current report start position for address resolution callback */ + pp = p; +#endif STREAM_TO_UINT16(evt_type, p); ext_adv_report.event_type = evt_type & 0x1F; if(ext_adv_report.event_type & BTM_BLE_ADV_LEGACY_MASK) { @@ -2616,8 +2597,9 @@ static void btu_ble_ext_adv_report_evt(UINT8 *p, UINT16 evt_len) match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE); if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) { btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_adv_ext, pp); - //the BDADDR may be updated, so read it again - p = p - sizeof(bda); + //the addr_type and BDADDR may be updated, so read them again + p = p - sizeof(bda) - 1; + STREAM_TO_UINT8(addr_type, p); STREAM_TO_BDADDR(bda, p); } } @@ -2633,6 +2615,14 @@ static void btu_ble_ext_adv_report_evt(UINT8 *p, UINT16 evt_len) STREAM_TO_UINT8(ext_adv_report.dir_addr_type, p); STREAM_TO_BDADDR(ext_adv_report.dir_addr, p); STREAM_TO_UINT8(ext_adv_report.adv_data_len, p); + remaining -= EXT_ADV_RPT_FIXED_LEN; + + if (ext_adv_report.adv_data_len > remaining) { + HCI_TRACE_ERROR("%s, adv_data_len %u exceeds remaining %u", + __func__, ext_adv_report.adv_data_len, remaining); + return; + } + if (ext_adv_report.adv_data_len) { ext_adv_report.adv_data = p; } else { @@ -2641,6 +2631,7 @@ static void btu_ble_ext_adv_report_evt(UINT8 *p, UINT16 evt_len) btm_ble_ext_adv_report_evt(&ext_adv_report); p += ext_adv_report.adv_data_len; + remaining -= ext_adv_report.adv_data_len; } } @@ -2688,6 +2679,13 @@ static void btu_ble_periodic_adv_sync_establish_evt(UINT8 *p, bool v2_evt) STREAM_TO_UINT8(sync_estab.rsp_slot_delay, p); STREAM_TO_UINT8(sync_estab.rsp_slot_spacing, p); } +#else + if (v2_evt) { + STREAM_SKIP_UINT8(p); + STREAM_SKIP_UINT8(p); + STREAM_SKIP_UINT8(p); + STREAM_SKIP_UINT8(p); + } #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) btm_ble_periodic_adv_sync_establish_evt(&sync_estab); @@ -2698,15 +2696,15 @@ static void btu_ble_periodic_adv_report_evt(UINT8 *p, UINT8 evt_len, bool v2_evt tBTM_PERIOD_ADV_REPORT adv_report = {0}; /* This parameter is intended to be used in a future feature. */ UINT8 unused = 0; - UINT8 min_len = MIN_BLE_PERIODIC_ADV_REPORT_LEN; + UINT8 min_len = v2_evt ? (MIN_BLE_PERIODIC_ADV_REPORT_LEN + 3) : MIN_BLE_PERIODIC_ADV_REPORT_LEN; if (!p) { HCI_TRACE_ERROR("%s, Invalid params.", __func__); return; } - if (evt_len < MIN_BLE_PERIODIC_ADV_REPORT_LEN) { - HCI_TRACE_ERROR("%s, Invalid params, the adv len is too short.", __func__); + if (evt_len < min_len) { + HCI_TRACE_ERROR("%s, Invalid params, the adv len %d is too short.", __func__, evt_len); return; } @@ -2718,7 +2716,11 @@ static void btu_ble_periodic_adv_report_evt(UINT8 *p, UINT8 evt_len, bool v2_evt if (v2_evt) { STREAM_TO_UINT16(adv_report.periodic_evt_cnt, p); STREAM_TO_UINT8(adv_report.subevt, p); - min_len += 3; + } +#else + if (v2_evt) { + STREAM_SKIP_UINT16(p); + STREAM_SKIP_UINT8(p); } #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) STREAM_TO_UINT8(adv_report.data_status, p); @@ -2917,6 +2919,15 @@ static void btu_ble_cis_established_evt(UINT8 *p, bool v2_evt) STREAM_TO_UINT24(cis_estab_evt.sdu_int_p_to_c, p); STREAM_TO_UINT8(cis_estab_evt.framing, p); } +#else + if (v2_evt) { + STREAM_SKIP_UINT24(p); + STREAM_SKIP_UINT16(p); + STREAM_SKIP_UINT16(p); + STREAM_SKIP_UINT24(p); + STREAM_SKIP_UINT24(p); + STREAM_SKIP_UINT8(p); + } #endif // #if (BLE_FEAT_ISO_60_EN == TRUE) btm_ble_cis_established_evt(&cis_estab_evt); @@ -2944,7 +2955,7 @@ static void btu_ble_cis_request_evt(UINT8 *p) } #endif // #if (BLE_FEAT_ISO_CIG_PERIPHERAL_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) void btu_ble_create_big_cmd_status(UINT8 status) { if (status != HCI_SUCCESS) { @@ -2954,7 +2965,7 @@ void btu_ble_create_big_cmd_status(UINT8 status) } } -static void btu_ble_big_create_complete_evt(UINT8 *p) +static void btu_ble_big_create_complete_evt(UINT8 *p, UINT8 evt_len) { HCI_TRACE_DEBUG("%s", __func__); tBTM_BLE_BIG_CREATE_CMPL big_cmpl = {0}; @@ -2965,6 +2976,15 @@ static void btu_ble_big_create_complete_evt(UINT8 *p) return; } + /* Fixed fields: status(1) + big_handle(1) + big_sync_delay(3) + * + transport_latency(3) + phy(1) + nse(1) + bn(1) + pto(1) + irc(1) + * + max_pdu(2) + iso_interval(2) + num_bis(1) = 18 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 18) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=18)", __func__, evt_len); + return; + } + STREAM_TO_UINT8(big_cmpl.status, p); STREAM_TO_UINT8(big_cmpl.big_handle, p); STREAM_TO_UINT24(big_cmpl.big_sync_delay, p); @@ -2978,11 +2998,14 @@ static void btu_ble_big_create_complete_evt(UINT8 *p) STREAM_TO_UINT16(big_cmpl.iso_interval, p); STREAM_TO_UINT8(num_bis, p); - // Validate num_bis to prevent buffer overflow if (num_bis > BLE_ISO_BIS_MAX_COUNT) { HCI_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT); num_bis = BLE_ISO_BIS_MAX_COUNT; } + if (num_bis > (evt_len - 18) / 2) { + HCI_TRACE_ERROR("%s, num_bis %d exceeds evt_len %u, truncating", __func__, num_bis, evt_len); + num_bis = (evt_len - 18) / 2; + } big_cmpl.num_bis = num_bis; for (uint8_t i = 0; i < num_bis; i++) @@ -3019,7 +3042,7 @@ static void btu_ble_big_terminate_complete_evt(UINT8 *p) btm_ble_big_terminate_cmpl_evt(&big_term); } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) void btu_ble_create_big_sync_cmd_status(UINT8 status) @@ -3031,7 +3054,7 @@ void btu_ble_create_big_sync_cmd_status(UINT8 status) } } -static void btu_ble_big_sync_establish_evt(UINT8 *p) +static void btu_ble_big_sync_establish_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_BIG_SYNC_ESTAB_CMPL big_estb = {0}; UINT8 num_bis; @@ -3041,6 +3064,15 @@ static void btu_ble_big_sync_establish_evt(UINT8 *p) return; } + /* Fixed fields: status(1) + big_handle(1) + transport_latency_big(3) + * + nse(1) + bn(1) + pto(1) + irc(1) + max_pdu(2) + iso_interval(2) + * + num_bis(1) = 14 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 14) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=14)", __func__, evt_len); + return; + } + STREAM_TO_UINT8(big_estb.status, p); STREAM_TO_UINT8(big_estb.big_handle, p); STREAM_TO_UINT24(big_estb.transport_latency_big, p); @@ -3052,11 +3084,14 @@ static void btu_ble_big_sync_establish_evt(UINT8 *p) STREAM_TO_UINT16(big_estb.iso_interval, p); STREAM_TO_UINT8(num_bis, p); - // Validate num_bis to prevent buffer overflow if (num_bis > BLE_ISO_BIS_MAX_COUNT) { HCI_TRACE_ERROR("%s, num_bis %d exceeds BLE_ISO_BIS_MAX_COUNT %d", __func__, num_bis, BLE_ISO_BIS_MAX_COUNT); num_bis = BLE_ISO_BIS_MAX_COUNT; } + if (num_bis > (evt_len - 14) / 2) { + HCI_TRACE_ERROR("%s, num_bis %d exceeds evt_len %u, truncating", __func__, num_bis, evt_len); + num_bis = (evt_len - 14) / 2; + } big_estb.num_bis = num_bis; for (uint8_t i = 0; i < num_bis; i++) @@ -3112,7 +3147,7 @@ static void btu_ble_biginfo_adv_report_evt(UINT8 *p) #if (BLE_FEAT_CTE_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) -static void btu_ble_cte_connless_iq_report_evt(UINT8 *p) +static void btu_ble_cte_connless_iq_report_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_CTE_CONNLESS_IQ_REPORT_EVT connless_iq_rpt = {0}; UINT8 sample_count; @@ -3122,6 +3157,15 @@ static void btu_ble_cte_connless_iq_report_evt(UINT8 *p) return; } + /* Fixed fields: sync_handle(2) + channel_idx(1) + rssi(2) + * + rssi_ant_id(1) + cte_type(1) + slot_dur(1) + pkt_status(1) + * + periodic_evt_counter(2) + sample_count(1) = 12 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 12) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=12)", __func__, evt_len); + return; + } + STREAM_TO_UINT16(connless_iq_rpt.sync_handle, p); STREAM_TO_UINT8(connless_iq_rpt.channel_idx, p); STREAM_TO_UINT16(connless_iq_rpt.rssi, p); @@ -3132,11 +3176,14 @@ static void btu_ble_cte_connless_iq_report_evt(UINT8 *p) STREAM_TO_UINT16(connless_iq_rpt.periodic_evt_counter, p); STREAM_TO_UINT8(sample_count, p); - // Validate sample_count to prevent buffer overflow if (sample_count > BTM_BLE_CTE_MAX_SAMPLE_COUNT) { HCI_TRACE_ERROR("%s, sample_count %d exceeds maximum %d", __func__, sample_count, BTM_BLE_CTE_MAX_SAMPLE_COUNT); sample_count = BTM_BLE_CTE_MAX_SAMPLE_COUNT; } + if (sample_count > (evt_len - 12) / 2) { + HCI_TRACE_ERROR("%s, sample_count %d exceeds evt_len %u, truncating", __func__, sample_count, evt_len); + sample_count = (evt_len - 12) / 2; + } connless_iq_rpt.sample_count = sample_count; for (uint8_t i = 0; i < sample_count; i++) @@ -3154,7 +3201,7 @@ static void btu_ble_cte_connless_iq_report_evt(UINT8 *p) #endif // #if (BLE_FEAT_CTE_CONNECTIONLESS_EN == TRUE) #if (BLE_FEAT_CTE_CONNECTION_EN == TRUE) -static void btu_ble_cte_conn_iq_report_evt(UINT8 *p) +static void btu_ble_cte_conn_iq_report_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_CTE_CONN_IQ_REPORT_EVT conn_iq_rpt = {0}; UINT8 sample_count; @@ -3164,6 +3211,15 @@ static void btu_ble_cte_conn_iq_report_evt(UINT8 *p) return; } + /* Fixed fields: conn_handle(2) + rx_phy(1) + data_channel_idx(1) + * + rssi(2) + rssi_ant_id(1) + cte_type(1) + slot_dur(1) + pkt_status(1) + * + conn_evt_counter(2) + sample_count(1) = 13 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 13) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=13)", __func__, evt_len); + return; + } + STREAM_TO_UINT16(conn_iq_rpt.conn_handle, p); STREAM_TO_UINT8(conn_iq_rpt.rx_phy, p); STREAM_TO_UINT8(conn_iq_rpt.data_channel_idx, p); @@ -3175,11 +3231,14 @@ static void btu_ble_cte_conn_iq_report_evt(UINT8 *p) STREAM_TO_UINT16(conn_iq_rpt.conn_evt_counter, p); STREAM_TO_UINT8(sample_count, p); - // Validate sample_count to prevent buffer overflow if (sample_count > BTM_BLE_CTE_MAX_SAMPLE_COUNT) { HCI_TRACE_ERROR("%s, sample_count %d exceeds maximum %d", __func__, sample_count, BTM_BLE_CTE_MAX_SAMPLE_COUNT); sample_count = BTM_BLE_CTE_MAX_SAMPLE_COUNT; } + if (sample_count > (evt_len - 13) / 2) { + HCI_TRACE_ERROR("%s, sample_count %d exceeds evt_len %u, truncating", __func__, sample_count, evt_len); + sample_count = (evt_len - 13) / 2; + } conn_iq_rpt.sample_count = sample_count; for (uint8_t i = 0; i < sample_count; i++) @@ -3285,7 +3344,7 @@ static void btu_ble_pa_subevt_data_request_evt(UINT8 *p) btm_ble_pa_subevt_data_req_evt(&pa_subevt_req_evt); } -static void btu_ble_pa_response_report_evt(UINT8 *p) +static void btu_ble_pa_response_report_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_PA_RSP_REPORT_EVT pa_rsp_rpt_evt = {0}; if (!p) { @@ -3293,33 +3352,58 @@ static void btu_ble_pa_response_report_evt(UINT8 *p) return; } + /* Fixed fields: adv_handle(1) + subevt(1) + tx_status(1) + num_rsp(1) = 4 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 4) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=4)", __func__, evt_len); + return; + } + STREAM_TO_UINT8(pa_rsp_rpt_evt.adv_handle, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.subevt, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.tx_status, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.num_rsp, p); - // num_rsp is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate + UINT8 remaining = evt_len - 4; + if (pa_rsp_rpt_evt.num_rsp) { pa_rsp_rpt_evt.rsp_data_info = osi_malloc(pa_rsp_rpt_evt.num_rsp * sizeof(tBTM_BLE_PA_RSP_DATA_INFO)); if (pa_rsp_rpt_evt.rsp_data_info) { for (UINT8 i = 0; i < pa_rsp_rpt_evt.num_rsp; i++) { + /* Per-response fixed: tx_power(1)+rssi(1)+cte_type(1)+rsp_slot(1)+data_status(1)+data_len(1) = 6 */ + if (remaining < 6) { + HCI_TRACE_ERROR("%s, remaining %u too short for response %d", __func__, remaining, i); + pa_rsp_rpt_evt.num_rsp = i; + break; + } STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].tx_power, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].rssi, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].cte_type, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].rsp_slot, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].data_status, p); STREAM_TO_UINT8(pa_rsp_rpt_evt.rsp_data_info[i].data_len, p); - // data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate + remaining -= 6; + if (pa_rsp_rpt_evt.rsp_data_info[i].data_len > remaining) { + HCI_TRACE_ERROR("%s, data_len %d exceeds remaining %u at index %d", + __func__, pa_rsp_rpt_evt.rsp_data_info[i].data_len, remaining, i); + pa_rsp_rpt_evt.rsp_data_info[i].data_len = 0; + pa_rsp_rpt_evt.rsp_data_info[i].data = NULL; + pa_rsp_rpt_evt.num_rsp = i + 1; + break; + } if (pa_rsp_rpt_evt.rsp_data_info[i].data_len) { pa_rsp_rpt_evt.rsp_data_info[i].data = osi_malloc(pa_rsp_rpt_evt.rsp_data_info[i].data_len); if (pa_rsp_rpt_evt.rsp_data_info[i].data) { STREAM_TO_ARRAY(pa_rsp_rpt_evt.rsp_data_info[i].data, p, pa_rsp_rpt_evt.rsp_data_info[i].data_len); } else { HCI_TRACE_ERROR("%s, no enough memory for data_len %d at index %d", __func__, pa_rsp_rpt_evt.rsp_data_info[i].data_len, i); + p += pa_rsp_rpt_evt.rsp_data_info[i].data_len; + remaining -= pa_rsp_rpt_evt.rsp_data_info[i].data_len; pa_rsp_rpt_evt.rsp_data_info[i].data_len = 0; } + remaining -= pa_rsp_rpt_evt.rsp_data_info[i].data_len; } else { pa_rsp_rpt_evt.rsp_data_info[i].data = NULL; } @@ -3468,13 +3552,25 @@ static void btu_ble_cs_proc_enable_cmpl_evt(UINT8 *p) btm_ble_cs_proc_enable_cmpl_evt(&proc_en); } -static void btu_ble_cs_subevt_result_evt(UINT8 *p) +static void btu_ble_cs_subevt_result_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_CS_SUBEVT_RESULT_CMPL_EVT subevt_result = {0}; if (!p) { HCI_TRACE_ERROR("%s, Invalid params.", __func__); return; } + + /* Fixed fields: conn_handle(2) + config_id(1) + + * start_acl_conn_event_counter(2) + procedure_counter(2) + + * frequency_compensation(2) + reference_power_level(1) + + * procedure_done_status(1) + subevent_done_status(1) + abort_reason(1) + + * num_ant_paths(1) + num_steps_reported(1) = 15 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 15) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=15)", __func__, evt_len); + return; + } + STREAM_TO_UINT16(subevt_result.conn_handle, p); STREAM_TO_UINT8(subevt_result.config_id, p); STREAM_TO_UINT16(subevt_result.start_acl_conn_event_counter, p); @@ -3488,27 +3584,49 @@ static void btu_ble_cs_subevt_result_evt(UINT8 *p) UINT8 num_steps_reported; STREAM_TO_UINT8(num_steps_reported, p); - // Validate num_steps_reported per BLE spec: Range 0x00 to 0xA0 (0 to 160) if (num_steps_reported > BTM_BLE_CS_MAX_STEPS_REPORTED) { HCI_TRACE_ERROR("%s, num_steps_reported %d exceeds maximum %d", __func__, num_steps_reported, BTM_BLE_CS_MAX_STEPS_REPORTED); num_steps_reported = BTM_BLE_CS_MAX_STEPS_REPORTED; } subevt_result.num_steps_reported = num_steps_reported; - subevt_result.step_info = osi_malloc(subevt_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO)); - if (subevt_result.step_info) { + UINT8 remaining = evt_len - 15; + subevt_result.step_info = (subevt_result.num_steps_reported > 0) + ? osi_malloc(subevt_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO)) + : NULL; + if (subevt_result.step_info || subevt_result.num_steps_reported == 0) { for (uint8_t i = 0; i < subevt_result.num_steps_reported; i++) { + /* Per-step fixed: step_mode(1) + step_channel(1) + step_data_len(1) = 3 */ + if (remaining < 3) { + HCI_TRACE_ERROR("%s, remaining %u too short for step %d", __func__, remaining, i); + subevt_result.num_steps_reported = i; + break; + } STREAM_TO_UINT8(subevt_result.step_info[i].step_mode, p); STREAM_TO_UINT8(subevt_result.step_info[i].step_channel, p); STREAM_TO_UINT8(subevt_result.step_info[i].step_data_len, p); - // step_data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate + remaining -= 3; + if (subevt_result.step_info[i].step_data_len > remaining) { + HCI_TRACE_ERROR("%s, step_data_len %d exceeds remaining %u at step %d", + __func__, subevt_result.step_info[i].step_data_len, remaining, i); + subevt_result.step_info[i].step_data_len = 0; + subevt_result.step_info[i].data = NULL; + subevt_result.num_steps_reported = i + 1; + break; + } subevt_result.step_info[i].data = osi_malloc(subevt_result.step_info[i].step_data_len); if (subevt_result.step_info[i].data) { STREAM_TO_ARRAY(subevt_result.step_info[i].data, p, subevt_result.step_info[i].step_data_len); } else if (subevt_result.step_info[i].step_data_len) { HCI_TRACE_ERROR("%s, no memory.", __func__); + p += subevt_result.step_info[i].step_data_len; + subevt_result.step_info[i].step_data_len = 0; + subevt_result.step_info[i].data = NULL; + subevt_result.num_steps_reported = i + 1; + break; } + remaining -= subevt_result.step_info[i].step_data_len; } } @@ -3527,7 +3645,7 @@ static void btu_ble_cs_subevt_result_evt(UINT8 *p) } -static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p) +static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p, UINT8 evt_len) { tBTM_BLE_CS_SUBEVT_RESULT_CONTINUE_EVT subevt_continue_result = {0}; @@ -3536,6 +3654,15 @@ static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p) return; } + /* Fixed fields: conn_handle(2) + config_id(1) + proc_done_status(1) + * + subevt_done_status(1) + abort_reason(1) + num_ant_paths(1) + * + num_steps_reported(1) = 8 bytes + * (subevent_code already subtracted from evt_len by caller) */ + if (evt_len < 8) { + HCI_TRACE_ERROR("%s, evt too short (len=%u, need>=8)", __func__, evt_len); + return; + } + STREAM_TO_UINT16(subevt_continue_result.conn_handle, p); STREAM_TO_UINT8(subevt_continue_result.config_id, p); STREAM_TO_UINT8(subevt_continue_result.proc_done_status, p); @@ -3545,27 +3672,50 @@ static void btu_ble_cs_subevt_result_continue_evt(UINT8 *p) UINT8 num_steps_reported; STREAM_TO_UINT8(num_steps_reported, p); - // Validate num_steps_reported per BLE spec: Range 0x00 to 0xA0 (0 to 160) if (num_steps_reported > BTM_BLE_CS_MAX_STEPS_REPORTED) { HCI_TRACE_ERROR("%s, num_steps_reported %d exceeds maximum %d", __func__, num_steps_reported, BTM_BLE_CS_MAX_STEPS_REPORTED); num_steps_reported = BTM_BLE_CS_MAX_STEPS_REPORTED; } subevt_continue_result.num_steps_reported = num_steps_reported; - subevt_continue_result.step_info = osi_malloc(subevt_continue_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO)); - if (subevt_continue_result.step_info) { + UINT8 remaining = evt_len - 8; + subevt_continue_result.step_info = (subevt_continue_result.num_steps_reported > 0) + ? osi_malloc(subevt_continue_result.num_steps_reported * sizeof(tBTM_BLE_CS_STEP_INFO)) + : NULL; + if (subevt_continue_result.step_info || subevt_continue_result.num_steps_reported == 0) { for (uint8_t i = 0; i < subevt_continue_result.num_steps_reported; i++) { + if (remaining < 3) { + HCI_TRACE_ERROR("%s, remaining %u too short for step %d", __func__, remaining, i); + subevt_continue_result.num_steps_reported = i; + break; + } STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_mode, p); STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_channel, p); STREAM_TO_UINT8(subevt_continue_result.step_info[i].step_data_len, p); - // step_data_len is UINT8, range 0x00 to 0xFF (0 to 255), no need to validate + remaining -= 3; + if (subevt_continue_result.step_info[i].step_data_len > remaining) { + HCI_TRACE_ERROR("%s, step_data_len %d exceeds remaining %u at step %d", + __func__, subevt_continue_result.step_info[i].step_data_len, remaining, i); + subevt_continue_result.step_info[i].step_data_len = 0; + subevt_continue_result.step_info[i].data = NULL; + subevt_continue_result.num_steps_reported = i + 1; + break; + } subevt_continue_result.step_info[i].data = osi_malloc(subevt_continue_result.step_info[i].step_data_len); if (subevt_continue_result.step_info[i].data) { STREAM_TO_ARRAY(subevt_continue_result.step_info[i].data, p, subevt_continue_result.step_info[i].step_data_len); } else if (subevt_continue_result.step_info[i].step_data_len) { HCI_TRACE_ERROR("%s, no memory.", __func__); + p += subevt_continue_result.step_info[i].step_data_len; + subevt_continue_result.step_info[i].step_data_len = 0; + subevt_continue_result.step_info[i].data = NULL; + subevt_continue_result.num_steps_reported = i + 1; + break; } + remaining -= subevt_continue_result.step_info[i].step_data_len; } + } else { + HCI_TRACE_ERROR("%s, no memory for step_info.", __func__); } btm_ble_cs_subevt_continue_result_evt(&subevt_continue_result); diff --git a/components/bt/host/bluedroid/stack/btu/btu_task.c b/components/bt/host/bluedroid/stack/btu/btu_task.c index 32588a3d6ea..2fe59a92601 100644 --- a/components/bt/host/bluedroid/stack/btu/btu_task.c +++ b/components/bt/host/bluedroid/stack/btu/btu_task.c @@ -449,7 +449,17 @@ void btu_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout_sec) osi_mutex_lock(&btu_general_alarm_lock, OSI_MUTEX_MAX_TIMEOUT); if (!hash_map_has_key(btu_general_alarm_hash_map, p_tle)) { alarm = osi_alarm_new("btu_gen", btu_general_alarm_cb, (void *)p_tle, 0); - hash_map_set(btu_general_alarm_hash_map, p_tle, alarm); + if (alarm == NULL) { + HCI_TRACE_ERROR("%s Unable to create new alarm", __func__); + osi_mutex_unlock(&btu_general_alarm_lock); + return; + } + if (!hash_map_set(btu_general_alarm_hash_map, p_tle, alarm)) { + HCI_TRACE_ERROR("%s Unable to set alarm in map", __func__); + osi_alarm_free(alarm); + osi_mutex_unlock(&btu_general_alarm_lock); + return; + } } osi_mutex_unlock(&btu_general_alarm_lock); @@ -564,7 +574,17 @@ void btu_start_quick_timer(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout_ti osi_mutex_lock(&btu_l2cap_alarm_lock, OSI_MUTEX_MAX_TIMEOUT); if (!hash_map_has_key(btu_l2cap_alarm_hash_map, p_tle)) { alarm = osi_alarm_new("btu_l2cap", btu_l2cap_alarm_cb, (void *)p_tle, 0); - hash_map_set(btu_l2cap_alarm_hash_map, p_tle, (void *)alarm); + if (alarm == NULL) { + HCI_TRACE_ERROR("%s Unable to create alarm", __func__); + osi_mutex_unlock(&btu_l2cap_alarm_lock); + return; + } + if (!hash_map_set(btu_l2cap_alarm_hash_map, p_tle, (void *)alarm)) { + HCI_TRACE_ERROR("%s Unable to set alarm in map", __func__); + osi_alarm_free(alarm); + osi_mutex_unlock(&btu_l2cap_alarm_lock); + return; + } } osi_mutex_unlock(&btu_l2cap_alarm_lock); @@ -650,7 +670,17 @@ void btu_start_timer_oneshot(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout_ osi_mutex_lock(&btu_oneshot_alarm_lock, OSI_MUTEX_MAX_TIMEOUT); if (!hash_map_has_key(btu_oneshot_alarm_hash_map, p_tle)) { alarm = osi_alarm_new("btu_oneshot", btu_oneshot_alarm_cb, (void *)p_tle, 0); - hash_map_set(btu_oneshot_alarm_hash_map, p_tle, alarm); + if (alarm == NULL) { + HCI_TRACE_ERROR("%s Unable to create new alarm", __func__); + osi_mutex_unlock(&btu_oneshot_alarm_lock); + return; + } + if (!hash_map_set(btu_oneshot_alarm_hash_map, p_tle, alarm)) { + HCI_TRACE_ERROR("%s Unable to set alarm in map", __func__); + osi_alarm_free(alarm); + osi_mutex_unlock(&btu_oneshot_alarm_lock); + return; + } } osi_mutex_unlock(&btu_oneshot_alarm_lock); diff --git a/components/bt/host/bluedroid/stack/gap/gap_ble.c b/components/bt/host/bluedroid/stack/gap/gap_ble.c index 154fcca0b03..97e7d9da822 100644 --- a/components/bt/host/bluedroid/stack/gap/gap_ble.c +++ b/components/bt/host/bluedroid/stack/gap/gap_ble.c @@ -315,6 +315,9 @@ UINT8 gap_proc_write_req( tGATTS_REQ_TYPE type, tGATT_WRITE_REQ *p_data) switch (p_db_attr->uuid) { #if (GATTS_DEVICE_NAME_WRITABLE == TRUE) case GATT_UUID_GAP_DEVICE_NAME: { + if (p_data->len > BD_NAME_LEN) { + return GATT_INVALID_ATTR_LEN; + } UINT8 *p_val = p_data->value; p_val[p_data->len] = '\0'; BTM_SetLocalDeviceName((char *)p_val, BT_DEVICE_TYPE_BLE); @@ -775,6 +778,7 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL { tGAP_CLCB *p_clcb; BOOLEAN started = FALSE; + BOOLEAN is_new_clcb = FALSE; if (p_cback == NULL && uuid != GATT_UUID_GAP_PREF_CONN_PARAM) { return (started); @@ -785,6 +789,7 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL GAP_TRACE_ERROR("gap_ble_accept_cl_operation max connection reached"); return started; } + is_new_clcb = TRUE; } GAP_TRACE_EVENT ("%s() - BDA: %08x%04x cl_op_uuid: 0x%04x", @@ -798,11 +803,25 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL /* hold the link here */ if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BT_TRANSPORT_LE, FALSE, FALSE, 0xFF, 0xFF)) { + if (is_new_clcb) { + gap_ble_dealloc_clcb(p_clcb); + } return started; } /* enqueue the request */ - gap_ble_enqueue_request(p_clcb, uuid, p_cback); + if (gap_ble_enqueue_request(p_clcb, uuid, p_cback) == FALSE) { + GAP_TRACE_ERROR("gap_ble_accept_cl_operation enqueue request failed"); + if (is_new_clcb) { + if (p_clcb->connected) { + GATT_Disconnect(p_clcb->conn_id); + } else { + GATT_CancelConnect(gap_cb.gatt_if, p_clcb->bda, TRUE); + } + gap_ble_dealloc_clcb(p_clcb); + } + return started; + } if (p_clcb->connected && p_clcb->cl_op_uuid == 0) { started = gap_ble_send_cl_read_request(p_clcb); diff --git a/components/bt/host/bluedroid/stack/gatt/att_protocol.c b/components/bt/host/bluedroid/stack/gatt/att_protocol.c index f2654f1a15b..686820071a8 100644 --- a/components/bt/host/bluedroid/stack/gatt/att_protocol.c +++ b/components/bt/host/bluedroid/stack/gatt/att_protocol.c @@ -166,6 +166,11 @@ BT_HDR *attp_build_read_by_type_value_cmd (UINT16 payload_size, tGATT_FIND_TYPE_ UINT8 *p; UINT16 len = p_value_type->value_len; + if (payload_size < GATT_DEF_BLE_MTU_SIZE) { + // never build packet smaller than default MTU size + return NULL; + } + if ((p_buf = (BT_HDR *)osi_malloc((UINT16)(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET))) != NULL) { p = (UINT8 *)(p_buf + 1) + L2CAP_MIN_OFFSET; diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_api.c b/components/bt/host/bluedroid/stack/gatt/gatt_api.c index dfceedf049d..ddab5b986f8 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_api.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_api.c @@ -1029,6 +1029,12 @@ tGATT_STATUS GATTC_Read (UINT16 conn_id, tGATT_READ_TYPE type, tGATT_READ_PARAM p_clcb->s_handle = 0; /* copy multiple handles in CB */ p_read_multi = (tGATT_READ_MULTI *)osi_malloc(sizeof(tGATT_READ_MULTI)); + if (p_read_multi == NULL) { + GATT_TRACE_ERROR("GATTC_Read no resources for multiple read"); + status = GATT_NO_RESOURCES; + gatt_clcb_dealloc(p_clcb); + return status; + } p_clcb->p_attr_buf = (UINT8 *)p_read_multi; memcpy (p_read_multi, &p_read->read_multiple, sizeof(tGATT_READ_MULTI)); case GATT_READ_BY_HANDLE: @@ -1382,7 +1388,8 @@ void GATT_Deregister (tGATT_IF gatt_if) (p_clcb->p_tcb->tcb_idx == p_tcb->tcb_idx)) { btu_stop_timer(&p_clcb->rsp_timer_ent); gatt_clcb_dealloc (p_clcb); - break; + // Removed break to ensure all CLCBs are cleaned up + // break; } } } @@ -1394,6 +1401,10 @@ void GATT_Deregister (tGATT_IF gatt_if) memset (p_reg, 0, sizeof(tGATT_REG)); } +void gatt_start_if_conn_cb(UINT8 tcb_idx, tBT_TRANSPORT transport, BD_ADDR bda) +{ + +} /******************************************************************************* ** @@ -1412,21 +1423,19 @@ void GATT_StartIf (tGATT_IF gatt_if) { tGATT_REG *p_reg; tGATT_TCB *p_tcb; - BD_ADDR bda; - UINT8 start_idx, found_idx; UINT16 conn_id; - tGATT_TRANSPORT transport ; + list_node_t *p_node = NULL; GATT_TRACE_API ("GATT_StartIf gatt_if=%d", gatt_if); if ((p_reg = gatt_get_regcb(gatt_if)) != NULL) { - start_idx = 0; - while (gatt_find_the_connected_bda(start_idx, bda, &found_idx, &transport)) { - p_tcb = gatt_find_tcb_by_addr(bda, transport); - if (p_reg->app_cb.p_conn_cb && p_tcb) { - conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if); - (*p_reg->app_cb.p_conn_cb)(gatt_if, bda, conn_id, TRUE, 0, transport); + for (p_node = list_begin(gatt_cb.p_tcb_list); p_node; p_node = list_next(p_node)) { + p_tcb = list_node(p_node); + if (p_tcb->in_use && p_tcb->ch_state == GATT_CH_OPEN) { + if (p_reg->app_cb.p_conn_cb && p_tcb) { + conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if); + (*p_reg->app_cb.p_conn_cb)(gatt_if, p_tcb->peer_bda, conn_id, TRUE, 0, p_tcb->transport); + } } - start_idx = ++found_idx; } } } @@ -1593,11 +1602,10 @@ tGATT_STATUS GATT_Disconnect (UINT16 conn_id) *******************************************************************************/ tGATT_STATUS GATT_SendServiceChangeIndication (BD_ADDR bd_addr) { - UINT8 start_idx, found_idx; BOOLEAN srv_chg_ind_pending = FALSE; tGATT_TCB *p_tcb; - tBT_TRANSPORT transport; tGATT_STATUS status = GATT_NOT_FOUND; + list_node_t *p_node = NULL; if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) { status = GATT_WRONG_STATE; @@ -1608,19 +1616,17 @@ tGATT_STATUS GATT_SendServiceChangeIndication (BD_ADDR bd_addr) if(bd_addr) { status = gatt_send_srv_chg_ind(bd_addr); } else { - start_idx = 0; - BD_ADDR addr; - while (gatt_find_the_connected_bda(start_idx, addr, &found_idx, &transport)) { - p_tcb = gatt_get_tcb_by_idx(found_idx); - srv_chg_ind_pending = gatt_is_srv_chg_ind_pending(p_tcb); - - if (!srv_chg_ind_pending) { - status = gatt_send_srv_chg_ind(addr); - } else { - status = GATT_BUSY; - GATT_TRACE_DEBUG("discard srv chg - already has one in the queue"); + for (p_node = list_begin(gatt_cb.p_tcb_list); p_node; p_node = list_next(p_node)) { + p_tcb = list_node(p_node); + if (p_tcb->in_use && p_tcb->ch_state == GATT_CH_OPEN) { + srv_chg_ind_pending = gatt_is_srv_chg_ind_pending(p_tcb); + if (!srv_chg_ind_pending) { + status = gatt_send_srv_chg_ind(p_tcb->peer_bda); + } else { + status = GATT_BUSY; + GATT_TRACE_DEBUG("discard srv chg - already has one in the queue"); + } } - start_idx = ++found_idx; } } diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_auth.c b/components/bt/host/bluedroid/stack/gatt/gatt_auth.c index e205815fed4..0a033e1ae04 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_auth.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_auth.c @@ -80,6 +80,8 @@ static BOOLEAN gatt_sign_data (tGATT_CLCB *p_clcb) } osi_free(p_data); + } else { + gatt_end_operation(p_clcb, GATT_NO_RESOURCES, NULL); } return status; diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c index 1bdbfaec08c..5d7c7e2bb39 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_cl.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_cl.c @@ -449,7 +449,7 @@ void gatt_process_find_type_value_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UIN void gatt_process_read_info_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_code, UINT16 len, UINT8 *p_data) { - tGATT_DISC_RES result; + tGATT_DISC_RES result = {0}; UINT8 *p = p_data, uuid_len = 0, type; UNUSED(p_tcb); @@ -472,6 +472,10 @@ void gatt_process_read_info_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_c uuid_len = LEN_UUID_16; } else if (type == GATT_INFO_TYPE_PAIR_128) { uuid_len = LEN_UUID_128; + } else { + GATT_TRACE_ERROR("invalid Info Response PDU format: %d", type); + gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL); + return; } while (len >= uuid_len + 2) { @@ -796,7 +800,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 if ((value_len > (p_tcb->payload_size - 2)) || (value_len > (len - 1)) ) { /* this is an error case that server's response containing a value length which is larger than MTU-2 or value_len > message total length -1 */ - GATT_TRACE_ERROR("gatt_process_read_by_type_rsp: Discard response op_code=%d vale_len=%d > (MTU-2=%d or msg_len-1=%d)", + GATT_TRACE_ERROR("gatt_process_read_by_type_rsp: Discard response op_code=%d value_len=%d > (MTU-2=%d or msg_len-1=%d)", op_code, value_len, (p_tcb->payload_size - 2), (len - 1)); gatt_end_operation(p_clcb, GATT_ERROR, NULL); return; @@ -884,7 +888,8 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 } /* read by type */ else if (p_clcb->operation == GATTC_OPTYPE_READ && p_clcb->op_subtype == GATT_READ_BY_TYPE) { - p_clcb->counter = len - 2; + /* value_len is the length of current record's value; use it to avoid overread when multiple records present */ + p_clcb->counter = value_len; p_clcb->s_handle = handle; if ( p_clcb->counter == (p_clcb->p_tcb->payload_size - 4)) { p_clcb->op_subtype = GATT_READ_BY_HANDLE; @@ -916,7 +921,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 /* UUID not matching */ if (!gatt_uuid_compare(record_value.dclr_value.char_uuid, p_clcb->uuid)) { - len -= (value_len + 2); + len -= (value_len + handle_len); continue; /* skip the result, and look for next one */ } else if (p_clcb->operation == GATTC_OPTYPE_READ) /* UUID match for read characteristic value */ @@ -1000,7 +1005,7 @@ void gatt_process_read_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_code, gatt_end_operation(p_clcb, GATT_SUCCESS, (void *)p_clcb->p_attr_buf); } } else { /* exception, should not happen */ - GATT_TRACE_ERROR("attr offset = %d p_attr_buf = %p ", offset, p_clcb->p_attr_buf); + GATT_TRACE_ERROR("attr offset = %d p_attr_buf = %p ", offset, p_clcb->p_attr_buf ? p_clcb->p_attr_buf:0); gatt_end_operation(p_clcb, GATT_NO_RESOURCES, (void *)p_clcb->p_attr_buf); } } @@ -1141,9 +1146,11 @@ BOOLEAN gatt_cl_send_next_cmd_inq(tGATT_TCB *p_tcb) } } else { GATT_TRACE_ERROR("gatt_cl_send_next_cmd_inq: L2CAP sent error"); - + /* attp_send_msg_to_l2cap() already freed p_cmd->p_cmd on failure */ + p_cmd->p_cmd = NULL; memset(p_cmd, 0, sizeof(tGATT_CMD_Q)); p_tcb->pending_cl_req ++; + p_tcb->pending_cl_req %= GATT_CL_MAX_LCB; p_cmd = &p_tcb->cl_cmd_q[p_tcb->pending_cl_req]; } diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_db.c b/components/bt/host/bluedroid/stack/gatt/gatt_db.c index 6c578e678f1..73037155f27 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_db.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_db.c @@ -363,6 +363,7 @@ tGATT_STATUS gatts_db_read_attr_value_by_type (tGATT_TCB *p_tcb, if (p_attr->handle >= s_handle && gatt_uuid_compare(type, attr_uuid)) { if (*p_len <= 2) { + *p_cur_handle = p_attr->handle; status = GATT_NO_RESOURCES; break; } @@ -375,15 +376,19 @@ tGATT_STATUS gatts_db_read_attr_value_by_type (tGATT_TCB *p_tcb, need_rsp = TRUE; status = gatts_send_app_read_request(p_tcb, op_code, p_attr->handle, 0, trans_id, need_rsp); - + if (status != GATT_PENDING) { + *p_cur_handle = p_attr->handle; + } /* one callback at a time */ break; } else if (status == GATT_SUCCESS || status == GATT_STACK_RSP) { if (status == GATT_STACK_RSP){ need_rsp = FALSE; status = gatts_send_app_read_request(p_tcb, op_code, p_attr->handle, 0, trans_id, need_rsp); - if(status == GATT_BUSY) + if (status != GATT_STACK_RSP) { + *p_cur_handle = p_attr->handle; break; + } if (!have_send_request){ have_send_request = true; @@ -400,6 +405,7 @@ tGATT_STATUS gatts_db_read_attr_value_by_type (tGATT_TCB *p_tcb, *p_len -= (len + 2); } else { GATT_TRACE_WARNING("format mismatch"); + *p_cur_handle = p_attr->handle; status = GATT_NO_RESOURCES; break; } @@ -546,6 +552,7 @@ UINT16 gatts_add_characteristic (tGATT_SVC_DB *p_db, tGATT_PERM perm, if (attr_val != NULL) { if (!copy_extra_byte_in_db(p_db, (void **)&p_char_val->p_value, sizeof(tGATT_ATTR_VAL))) { + deallocate_attr_in_db(p_db, p_char_decl); deallocate_attr_in_db(p_db, p_char_val); return 0; } @@ -733,7 +740,7 @@ tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle, } p_cur = (tGATT_ATTR16 *) p_db->p_attr_list; - + BOOLEAN found = FALSE; while (p_cur != NULL) { if (p_cur->handle == attr_handle) { /* for characteristic should not be set, return GATT_NOT_FOUND */ @@ -758,13 +765,14 @@ tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle, } else{ memcpy(p_cur->p_value->attr_val.attr_val, value, length); p_cur->p_value->attr_val.attr_len = length; + found = TRUE; } break; } p_cur = p_cur->p_next; } - return GATT_SUCCESS; + return found ? GATT_SUCCESS : GATT_NOT_FOUND; } /******************************************************************************* @@ -1205,8 +1213,8 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code, GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHORIZATION,handle %04x,perm %04x", handle, perm); } /* LE security mode 2 attribute */ - else if (perm & GATT_WRITE_SIGNED_PERM && op_code != GATT_SIGN_CMD_WRITE && !(sec_flag & GATT_SEC_FLAG_ENCRYPTED) - && (perm & GATT_WRITE_ALLOWED) == 0) { + else if ((perm & GATT_WRITE_SIGNED_PERM) && op_code != GATT_SIGN_CMD_WRITE && !(sec_flag & GATT_SEC_FLAG_ENCRYPTED) + && !(perm & (GATT_PERM_WRITE | GATT_PERM_WRITE_ENCRYPTED | GATT_PERM_WRITE_ENC_MITM))) { status = GATT_INSUF_AUTHENTICATION; GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION: LE security mode 2 required,handle %04x,perm %04x", handle, perm); } else { /* writable: must be char value declaration or char descriptors */ diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_main.c b/components/bt/host/bluedroid/stack/gatt/gatt_main.c index 30b2d468332..5d57534f6ca 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_main.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_main.c @@ -1174,27 +1174,25 @@ void gatt_init_srv_chg (void) #if (GATTS_INCLUDED == TRUE) void gatt_proc_srv_chg (void) { - UINT8 start_idx, found_idx; - BD_ADDR bda; BOOLEAN srv_chg_ind_pending = FALSE; tGATT_TCB *p_tcb; - tBT_TRANSPORT transport; + list_node_t *p_node = NULL; GATT_TRACE_DEBUG ("gatt_proc_srv_chg"); if (gatt_cb.cb_info.p_srv_chg_callback && gatt_cb.handle_of_h_r) { gatt_set_srv_chg(); - start_idx = 0; - while (gatt_find_the_connected_bda(start_idx, bda, &found_idx, &transport)) { - p_tcb = gatt_get_tcb_by_idx(found_idx); - srv_chg_ind_pending = gatt_is_srv_chg_ind_pending(p_tcb); - if (!srv_chg_ind_pending) { - gatt_send_srv_chg_ind(bda); - } else { - GATT_TRACE_DEBUG ("discard srv chg - already has one in the queue"); + for (p_node = list_begin(gatt_cb.p_tcb_list); p_node; p_node = list_next(p_node)) { + p_tcb = list_node(p_node); + if (p_tcb->in_use && p_tcb->ch_state == GATT_CH_OPEN) { + srv_chg_ind_pending = gatt_is_srv_chg_ind_pending(p_tcb); + if (!srv_chg_ind_pending) { + gatt_send_srv_chg_ind(p_tcb->peer_bda); + } else { + GATT_TRACE_DEBUG ("discard srv chg - already has one in the queue"); + } } - start_idx = ++found_idx; } } } diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_sr.c b/components/bt/host/bluedroid/stack/gatt/gatt_sr.c index 118dad4cb3e..62b170b1a26 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_sr.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_sr.c @@ -166,6 +166,12 @@ static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status, GATT_TRACE_DEBUG ("process_read_multi_rsp status=%d mtu=%d", status, mtu); + if (!p_msg) { + p_cmd->status = GATT_INVALID_PDU; + GATT_TRACE_ERROR("process_read_multi_rsp - invalid p_msg"); + return TRUE; + } + if (p_cmd->multi_rsp_q == NULL) { p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX); } @@ -287,6 +293,12 @@ static BOOLEAN process_read_multi_var_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS sta GATT_TRACE_DEBUG ("process_read_multi_var rsp status=%d mtu=%d", status, mtu); + if (!p_msg) { + GATT_TRACE_ERROR("process_read_multi_var_rsp - invalid p_msg"); + p_cmd->status = GATT_INVALID_PDU; + return TRUE; + } + if (p_cmd->multi_rsp_q == NULL) { p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX); } @@ -474,9 +486,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U tGATT_IF gatt_if; UINT16 conn_id; UINT16 queue_num = 0; - BOOLEAN is_first = TRUE; + UINT16 zeroed_cap = 0, zeroed_count = 0; + void **zeroed_attrs = NULL; BOOLEAN is_prepare_write_valid = FALSE; BOOLEAN is_need_dequeue_sr_cmd = FALSE; + BOOLEAN sr_cmd_already_dequeued = FALSE; tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL; tGATT_PREPARE_WRITE_QUEUE_DATA * queue_data = NULL; @@ -517,6 +531,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U gatt_exec_write_rsp.op_code = GATT_RSP_EXEC_WRITE; gatt_send_packet(p_tcb, (UINT8 *)(&gatt_exec_write_rsp), sizeof(gatt_exec_write_rsp)); gatt_dequeue_sr_cmd(p_tcb); + sr_cmd_already_dequeued = TRUE; if (flag != GATT_PREP_WRITE_CANCEL){ is_prepare_write_valid = TRUE; } @@ -537,23 +552,99 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U gatt_send_error_rsp(p_tcb, prepare_record->error_code_app, GATT_REQ_EXEC_WRITE, 0, is_need_dequeue_sr_cmd); } - //dequeue prepare write data + /* Track which attributes we've zeroed so we only zero on first write per attribute. + * Zeroing all up-front would leave attr_len=0 for attributes whose write is later + * skipped (e.g. overflow), causing data loss. */ + if (is_prepare_write_valid && queue_num > 0) { + zeroed_cap = queue_num; /* max unique attributes in this exec is at most queue_num */ + zeroed_attrs = (void **)osi_calloc(zeroed_cap * sizeof(void *)); + if (zeroed_attrs == NULL) { + GATT_TRACE_ERROR("%s: no memory for zeroed_attrs, abort exec write", __func__); + while (fixed_queue_try_peek_first(prepare_record->queue)) { + queue_data = fixed_queue_dequeue(prepare_record->queue, FIXED_QUEUE_MAX_TIMEOUT); + osi_free(queue_data); + } + fixed_queue_free(prepare_record->queue, NULL); + prepare_record->queue = NULL; + { + UINT16 total_num_saved = prepare_record->total_num; + prepare_record->total_num = 0; + prepare_record->error_code_app = GATT_SUCCESS; + /* Only send error (and dequeue via gatt_send_error_rsp) if we did not already send success and dequeue (first branch) */ + if (!sr_cmd_already_dequeued) { + gatt_send_error_rsp(p_tcb, GATT_NO_RESOURCES, GATT_REQ_EXEC_WRITE, 0, TRUE); + } else { + /* Success already sent to peer; notify apps and clear prep_cnt so state stays consistent */ + if (!gatt_sr_is_prep_cnt_zero(p_tcb)) { + if (total_num_saved > queue_num) { + trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0); + gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb); + } + for (i = 0; i < GATT_MAX_APPS; i++) { + if (p_tcb->prep_cnt[i]) { + gatt_if = (tGATT_IF) (i + 1); + conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if); + gatt_sr_send_req_callback(conn_id, + trans_id, + GATTS_REQ_TYPE_WRITE_EXEC, + (tGATTS_DATA *)&flag); + p_tcb->prep_cnt[i] = 0; + } + } + /* OOM path: we enqueued sr_cmd but will not get app response flow; clear sr_cmd so later requests are not dropped */ + if (total_num_saved > queue_num) { + gatt_dequeue_sr_cmd(p_tcb); + } + } + } + } + return; + } + } + while(fixed_queue_try_peek_first(prepare_record->queue)) { queue_data = fixed_queue_dequeue(prepare_record->queue, FIXED_QUEUE_MAX_TIMEOUT); if (is_prepare_write_valid){ if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){ - if(is_first) { - //clear attr_val.attr_len before handle prepare write data - queue_data->p_attr->p_value->attr_val.attr_len = 0; - is_first = FALSE; + UINT16 attr_max_len = queue_data->p_attr->p_value->attr_val.attr_max_len; + if (queue_data->offset > attr_max_len || + queue_data->len > attr_max_len - queue_data->offset) { + GATT_TRACE_ERROR("%s: exec write overflow prevented, offset=%u len=%u max=%u", + __func__, queue_data->offset, queue_data->len, attr_max_len); + } else { + UINT16 k; + BOOLEAN need_zero = TRUE; + /* Zero attr_len only on first successful write to this attribute in this exec */ + if (zeroed_attrs != NULL) { + for (k = 0; k < zeroed_count; k++) { + if (zeroed_attrs[k] == (void *)queue_data->p_attr) { + need_zero = FALSE; + break; + } + } + } + if (need_zero) { + queue_data->p_attr->p_value->attr_val.attr_len = 0; + if (zeroed_attrs != NULL && zeroed_count < zeroed_cap) { + zeroed_attrs[zeroed_count++] = (void *)queue_data->p_attr; + } + } + memcpy(queue_data->p_attr->p_value->attr_val.attr_val + queue_data->offset, + queue_data->value, queue_data->len); + { + UINT16 write_end = queue_data->offset + queue_data->len; + if (write_end > queue_data->p_attr->p_value->attr_val.attr_len) { + queue_data->p_attr->p_value->attr_val.attr_len = write_end; + } + } } - memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len); - //don't forget to increase the attribute value length in the gatts database. - queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len; } } osi_free(queue_data); } + if (zeroed_attrs != NULL) { + osi_free(zeroed_attrs); + } fixed_queue_free(prepare_record->queue, NULL); prepare_record->queue = NULL; diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_sr_hash.c b/components/bt/host/bluedroid/stack/gatt/gatt_sr_hash.c index d5a4b3a5e96..79c6fdb2079 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_sr_hash.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_sr_hash.c @@ -56,6 +56,15 @@ static void attr_uuid_to_bt_uuid(void *p_attr, tBT_UUID *p_uuid) } } +static UINT8 get_uuid_stream_len(tBT_UUID uuid) +{ + // gatt_build_uuid_to_stream always converts 32-bit UUID to 128-bit UUID + if (uuid.len == LEN_UUID_32) { + return LEN_UUID_128; + } + return uuid.len; +} + static size_t calculate_database_info_size(void) { UINT8 i; @@ -71,17 +80,20 @@ static size_t calculate_database_info_size(void) if (p_attr->uuid == GATT_UUID_PRI_SERVICE || p_attr->uuid == GATT_UUID_SEC_SERVICE) { // Service declaration - len += 4 + p_attr->p_value->uuid.len; + len += 4 + get_uuid_stream_len(p_attr->p_value->uuid); } else if (p_attr->uuid == GATT_UUID_INCLUDE_SERVICE) { // Included service declaration - len += 8 + p_attr->p_value->incl_handle.service_type.len; + len += 8 + get_uuid_stream_len(p_attr->p_value->incl_handle.service_type); } else if (p_attr->uuid == GATT_UUID_CHAR_DECLARE) { tBT_UUID char_uuid = {0}; - // Characteristic declaration + if (p_attr->p_next == NULL) { + GATT_TRACE_ERROR("%s: malformed DB, char decl at handle %u has no value attr", + __func__, p_attr->handle); + break; + } p_attr = (tGATT_ATTR16 *)p_attr->p_next; attr_uuid_to_bt_uuid((void *)p_attr, &char_uuid); - // Increment 1 to fetch characteristic uuid from value declaration attribute - len += 7 + char_uuid.len; + len += 7 + get_uuid_stream_len(char_uuid); } else if (p_attr->uuid == GATT_UUID_CHAR_DESCRIPTION || p_attr->uuid == GATT_UUID_CHAR_CLIENT_CONFIG || p_attr->uuid == GATT_UUID_CHAR_SRVR_CONFIG || @@ -127,14 +139,17 @@ static void fill_database_info(UINT8 *p_data) gatt_build_uuid_to_stream(&p_data, p_attr->p_value->incl_handle.service_type); } else if (p_attr->uuid == GATT_UUID_CHAR_DECLARE) { tBT_UUID char_uuid = {0}; - // Characteristic declaration + if (p_attr->p_next == NULL) { + GATT_TRACE_ERROR("%s: malformed DB, char decl at handle %u has no value attr", + __func__, p_attr->handle); + break; + } UINT16_TO_STREAM(p_data, p_attr->handle); UINT16_TO_STREAM(p_data, GATT_UUID_CHAR_DECLARE); UINT8_TO_STREAM(p_data, p_attr->p_value->char_decl.property); UINT16_TO_STREAM(p_data, p_attr->p_value->char_decl.char_val_handle); p_attr = (tGATT_ATTR16 *)p_attr->p_next; attr_uuid_to_bt_uuid((void *)p_attr, &char_uuid); - // Increment 1 to fetch characteristic uuid from value declaration attribute gatt_build_uuid_to_stream(&p_data, char_uuid); } else if (p_attr->uuid == GATT_UUID_CHAR_DESCRIPTION || p_attr->uuid == GATT_UUID_CHAR_CLIENT_CONFIG || @@ -151,6 +166,7 @@ static void fill_database_info(UINT8 *p_data) // TODO: process extended properties descriptor if (p_attr->p_value->attr_val.attr_len == 2) { memcpy(p_data, p_attr->p_value->attr_val.attr_val, 2); + p_data += 2; } else { UINT16_TO_STREAM(p_data, 0x0000); } @@ -171,6 +187,11 @@ tGATT_STATUS gatts_calculate_datebase_hash(BT_OCTET16 hash) len = calculate_database_info_size(); + if (len == 0) { + memset(hash, 0, BT_OCTET16_LEN); + return GATT_SUCCESS; + } + data_buf = (UINT8 *)osi_malloc(len); if (data_buf == NULL) { GATT_TRACE_ERROR ("%s failed to allocate buffer (%u)\n", __func__, len); @@ -227,6 +248,10 @@ void gatts_show_local_database(void) tBT_UUID char_uuid = {0}; tGATT_ATTR16 *p_char_val; p_char_val = (tGATT_ATTR16 *)p_attr->p_next; + if (p_char_val == NULL) { + printf("characteristic (malformed - no value attr)\n"); + break; + } attr_uuid_to_bt_uuid((void *)p_char_val, &char_uuid); printf("%s\n", gatt_get_attr_name(p_attr->uuid)); diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_utils.c b/components/bt/host/bluedroid/stack/gatt/gatt_utils.c index 9d38c24292b..0782a32c16e 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_utils.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_utils.c @@ -74,7 +74,7 @@ const char *const op_code_name[] = { "ATT_OP_CODE_MAX" }; -static const UINT8 base_uuid[LEN_UUID_128] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, +const UINT8 base_uuid[LEN_UUID_128] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; @@ -216,11 +216,12 @@ tGATTS_PENDING_NEW_SRV_START *gatt_sr_is_new_srv_chg(tBT_UUID *p_app_uuid128, tB list_t *list = fixed_queue_get_list(gatt_cb.pending_new_srv_start_q); for (const list_node_t *node = list_begin(list); node != list_end(list); node = list_next(node)) { - p_buf = (tGATTS_PENDING_NEW_SRV_START *)list_node(node); - tGATTS_HNDL_RANGE *p = p_buf->p_new_srv_start; + tGATTS_PENDING_NEW_SRV_START *p_temp = (tGATTS_PENDING_NEW_SRV_START *)list_node(node); + tGATTS_HNDL_RANGE *p = p_temp->p_new_srv_start; if (gatt_uuid_compare(*p_app_uuid128, p->app_uuid128) && gatt_uuid_compare (*p_svc_uuid, p->svc_uuid) && (svc_inst == p->svc_inst)) { + p_buf = p_temp; GATT_TRACE_DEBUG("gatt_sr_is_new_srv_chg: Yes"); break; } @@ -449,19 +450,17 @@ void gatt_free_hdl_buffer(tGATT_HDL_LIST_ELEM *p) void gatt_free_srvc_db_buffer_app_id(tBT_UUID *p_app_id) { tGATT_HDL_LIST_ELEM *p_elem = &gatt_cb.hdl_list[0]; + tGATT_HDL_LIST_INFO *p_list_info = &gatt_cb.hdl_list_info; UINT8 i; for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_elem ++) { if (memcmp(p_app_id, &p_elem->asgn_range.app_uuid128, sizeof(tBT_UUID)) == 0) { + /* Remove from linked list first */ + gatt_remove_an_item_from_list(p_list_info, p_elem); + /* Free attribute value buffers */ gatt_free_attr_value_buffer(p_elem); - while (!fixed_queue_is_empty(p_elem->svc_db.svc_buffer)) { - osi_free(fixed_queue_dequeue(p_elem->svc_db.svc_buffer, 0)); - } - fixed_queue_free(p_elem->svc_db.svc_buffer, NULL); - p_elem->svc_db.svc_buffer = NULL; - - p_elem->svc_db.mem_free = 0; - p_elem->svc_db.p_attr_list = p_elem->svc_db.p_free_mem = NULL; + /* Free the handle buffer completely (including svc_buffer and setting in_use = FALSE) */ + gatt_free_hdl_buffer(p_elem); } } } @@ -631,7 +630,17 @@ BOOLEAN gatt_remove_a_srv_from_list(tGATT_SRV_LIST_INFO *p_list, tGATT_SRV_LIST_ p_remove->p_next->p_prev = p_remove->p_prev; p_remove->p_prev->p_next = p_remove->p_next; } - p_list->count--; + // If the list is now empty, update p_last to NULL + if(p_list->p_first == NULL) { + p_list->p_last = NULL; + } + if (p_list->count) { + p_list->count --; + } else { + GATT_TRACE_ERROR("Error: p_list->count is already zero"); + } + + gatt_update_last_pri_srv_info(p_list); return TRUE; @@ -722,46 +731,20 @@ BOOLEAN gatt_remove_an_item_from_list(tGATT_HDL_LIST_INFO *p_list, tGATT_HDL_LIS p_remove->p_next->p_prev = p_remove->p_prev; p_remove->p_prev->p_next = p_remove->p_next; } - p_list->count--; + // If the list is now empty, update p_last to NULL + if (p_list->p_first == NULL) { + p_list->p_last = NULL; + } + + if(p_list->count > 0) { + p_list->count--; + } else { + GATT_TRACE_ERROR("Error: p_list->count is already zero"); + } return TRUE; } -/******************************************************************************* -** -** Function gatt_find_the_connected_bda -** -** Description This function find the connected bda -** -** Returns TRUE if found -** -*******************************************************************************/ -BOOLEAN gatt_find_the_connected_bda(UINT8 start_idx, BD_ADDR bda, UINT8 *p_found_idx, - tBT_TRANSPORT *p_transport) -{ - BOOLEAN found = FALSE; - GATT_TRACE_DEBUG("gatt_find_the_connected_bda start_idx=%d", start_idx); - tGATT_TCB *p_tcb = NULL; - list_node_t *p_node = NULL; - p_tcb = gatt_get_tcb_by_idx(start_idx); - if (p_tcb) { - for(p_node = list_get_node(gatt_cb.p_tcb_list, p_tcb); p_node; p_node = list_next(p_node)) { - p_tcb = list_node(p_node); - if (p_tcb->in_use && p_tcb->ch_state == GATT_CH_OPEN) { - memcpy( bda, p_tcb->peer_bda, BD_ADDR_LEN); - *p_found_idx = p_tcb->tcb_idx; - *p_transport = p_tcb->transport; - found = TRUE; - GATT_TRACE_DEBUG("gatt_find_the_connected_bda bda :%02x-%02x-%02x-%02x-%02x-%02x", - bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]); - break; - } - } - GATT_TRACE_DEBUG("gatt_find_the_connected_bda found=%d found_idx=%d", found, p_tcb->tcb_idx); - } - return found; -} - #if (GATTS_INCLUDED == TRUE) /******************************************************************************* ** @@ -814,11 +797,11 @@ tGATTS_SRV_CHG *gatt_is_bda_in_the_srv_chg_clt_list (BD_ADDR bda) p_buf = (tGATTS_SRV_CHG *)list_node(node); if (!memcmp( bda, p_buf->bda, BD_ADDR_LEN)) { GATT_TRACE_DEBUG("bda is in the srv chg clt list"); - break; + return p_buf; } } - return p_buf; + return NULL; } #endif // (GATTS_INCLUDED == TRUE) @@ -1023,11 +1006,11 @@ tGATT_TCB *gatt_allocate_tcb_by_bdaddr(BD_ADDR bda, tBT_TRANSPORT transport) allocated = TRUE; } if (i != GATT_INDEX_INVALID) { - p_tcb = gatt_tcb_alloc(i); - if (!p_tcb) { - return NULL; - } if (allocated) { + p_tcb = gatt_tcb_alloc(i); + if (!p_tcb) { + return NULL; + } memset(p_tcb, 0, sizeof(tGATT_TCB)); #if (SMP_INCLUDED == TRUE) p_tcb->pending_enc_clcb = fixed_queue_new(QUEUE_SIZE_MAX); @@ -1035,6 +1018,11 @@ tGATT_TCB *gatt_allocate_tcb_by_bdaddr(BD_ADDR bda, tBT_TRANSPORT transport) p_tcb->in_use = TRUE; p_tcb->tcb_idx = i; p_tcb->transport = transport; + } else { + p_tcb = gatt_get_tcb_by_idx(i); + if (!p_tcb) { + return NULL; + } } memcpy(p_tcb->peer_bda, bda, BD_ADDR_LEN); #if GATTS_ROBUST_CACHING_ENABLED @@ -1736,14 +1724,18 @@ tGATT_CLCB *gatt_clcb_alloc (UINT16 conn_id) if (list_length(gatt_cb.p_clcb_list) < GATT_CL_MAX_LCB) { p_clcb = (tGATT_CLCB *)osi_malloc(sizeof(tGATT_CLCB)); if (p_clcb) { - list_append(gatt_cb.p_clcb_list, p_clcb); - memset(p_clcb, 0, sizeof(tGATT_CLCB)); - p_clcb->in_use = TRUE; - p_clcb->conn_id = conn_id; - //Add index of the clcb same as conn_id - p_clcb->clcb_idx = conn_id; - p_clcb->p_reg = p_reg; - p_clcb->p_tcb = p_tcb; + if (!list_append(gatt_cb.p_clcb_list, p_clcb)) { + osi_free(p_clcb); + GATT_TRACE_ERROR("gatt_clcb_alloc: could not add clcb to list"); + return NULL; + } + memset(p_clcb, 0, sizeof(tGATT_CLCB)); + p_clcb->in_use = TRUE; + p_clcb->conn_id = conn_id; + //Add index of the clcb same as conn_id + p_clcb->clcb_idx = conn_id; + p_clcb->p_reg = p_reg; + p_clcb->p_tcb = p_tcb; } } return p_clcb; @@ -1761,6 +1753,10 @@ tGATT_CLCB *gatt_clcb_alloc (UINT16 conn_id) void gatt_clcb_dealloc (tGATT_CLCB *p_clcb) { if (p_clcb && p_clcb->in_use) { + if (p_clcb->p_attr_buf) { + osi_free(p_clcb->p_attr_buf); + p_clcb->p_attr_buf = NULL; + } btu_free_timer(&p_clcb->rsp_timer_ent); memset(p_clcb, 0, sizeof(tGATT_CLCB)); list_remove(gatt_cb.p_clcb_list, p_clcb); @@ -1787,10 +1783,10 @@ tGATT_TCB *gatt_find_tcb_by_cid (UINT16 lcid) for(p_node = list_begin(gatt_cb.p_tcb_list); p_node; p_node = list_next(p_node)) { p_tcb = list_node(p_node); if (p_tcb->in_use && p_tcb->att_lcid == lcid) { - break; + return p_tcb; } } - return p_tcb; + return NULL; } /******************************************************************************* @@ -1978,7 +1974,7 @@ void gatt_sr_update_cback_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN is_inc #if (GATTS_INCLUDED == TRUE) UINT8 idx = ((UINT8) gatt_if) - 1 ; - if (p_tcb) { + if (p_tcb && idx < GATT_MAX_APPS) { if (is_reset_first) { gatt_sr_reset_cback_cnt(p_tcb); } @@ -2008,9 +2004,9 @@ void gatt_sr_update_prep_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN is_inc, UINT8 idx = ((UINT8) gatt_if) - 1 ; GATT_TRACE_DEBUG("gatt_sr_update_prep_cnt tcb idx=%d gatt_if=%d is_inc=%d is_reset_first=%d", - p_tcb->tcb_idx, gatt_if, is_inc, is_reset_first); + p_tcb ? p_tcb->tcb_idx : 0, gatt_if, is_inc, is_reset_first); - if (p_tcb) { + if (p_tcb && idx < GATT_MAX_APPS) { if (is_reset_first) { gatt_sr_reset_prep_cnt(p_tcb); } @@ -2173,6 +2169,11 @@ UINT8 gatt_send_write_msg (tGATT_TCB *p_tcb, UINT16 clcb_idx, UINT8 op_code, { tGATT_CL_MSG msg; + if (len > GATT_MAX_ATTR_LEN) { + GATT_TRACE_ERROR("%s: len %u exceeds max %u", __func__, len, GATT_MAX_ATTR_LEN); + return GATT_ILLEGAL_PARAMETER; + } + msg.attr_value.handle = handle; msg.attr_value.len = len; msg.attr_value.offset = offset; @@ -2265,6 +2266,7 @@ void gatt_end_operation(tGATT_CLCB *p_clcb, tGATT_STATUS status, void *p_data) if (p_clcb->p_attr_buf) { osi_free(p_clcb->p_attr_buf); + p_clcb->p_attr_buf = NULL; } #if !CONFIG_BT_STACK_NO_LOG @@ -2320,9 +2322,9 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport) GATT_TRACE_DEBUG ("found p_clcb conn_id=%d clcb_idx=%d", p_clcb->conn_id, p_clcb->clcb_idx); if (p_clcb->operation != GATTC_OPTYPE_NONE) { gatt_end_operation(p_clcb, GATT_ERROR, NULL); - p_clcb = NULL; + } else { + gatt_clcb_dealloc(p_clcb); } - gatt_clcb_dealloc(p_clcb); } } #if (GATTC_INCLUDED == TRUE) @@ -2540,7 +2542,7 @@ BOOLEAN gatt_add_bg_dev_list(tGATT_REG *p_reg, BD_ADDR bd_addr, BOOLEAN is_init if (i == 0) { // To check, we do not support background connection, code will not be called here - ret = BTM_BleUpdateAdvWhitelist(TRUE, bd_addr, 0, NULL); + ret = BTM_BleUpdateAdvWhitelist(TRUE, bd_addr, 0); } else { ret = TRUE; } @@ -2681,7 +2683,7 @@ BOOLEAN gatt_remove_bg_dev_from_list(tGATT_REG *p_reg, BD_ADDR bd_addr, BOOLEAN if (p_dev->listen_gif[0] == 0) { // To check, we do not support background connection, code will not be called here - ret = BTM_BleUpdateAdvWhitelist(FALSE, p_dev->remote_bda, 0, NULL); + ret = BTM_BleUpdateAdvWhitelist(FALSE, p_dev->remote_bda, 0); } else { ret = TRUE; } @@ -2743,7 +2745,7 @@ void gatt_deregister_bgdev_list(tGATT_IF gatt_if) if (p_dev_list->listen_gif[0] == 0) { // To check, we do not support background connection, code will not be called here - BTM_BleUpdateAdvWhitelist(FALSE, p_dev_list->remote_bda, 0, NULL); + BTM_BleUpdateAdvWhitelist(FALSE, p_dev_list->remote_bda, 0); } } } diff --git a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h index 4d5ea687764..76432c4f1b6 100644 --- a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h +++ b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h @@ -603,6 +603,8 @@ extern void gatt_set_err_rsp(BOOLEAN enable, UINT8 req_op_code, UINT8 err_status } #endif +extern const UINT8 base_uuid[LEN_UUID_128]; + /* internal functions */ extern void gatt_init (void); extern void gatt_free(void); @@ -658,7 +660,6 @@ extern tGATTS_PENDING_NEW_SRV_START *gatt_sr_is_new_srv_chg(tBT_UUID *p_app_uuid extern BOOLEAN gatt_is_srv_chg_ind_pending (tGATT_TCB *p_tcb); extern tGATTS_SRV_CHG *gatt_is_bda_in_the_srv_chg_clt_list (BD_ADDR bda); -extern BOOLEAN gatt_find_the_connected_bda(UINT8 start_idx, BD_ADDR bda, UINT8 *p_found_idx, tBT_TRANSPORT *p_transport); extern void gatt_set_srv_chg(void); extern void gatt_delete_dev_from_srv_chg_clt_list(BD_ADDR bd_addr); extern tGATTS_PENDING_NEW_SRV_START *gatt_add_pending_new_srv_start( tGATTS_HNDL_RANGE *p_new_srv_start); diff --git a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c index eafe0b69429..1f17d20f43e 100644 --- a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c +++ b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c @@ -33,7 +33,7 @@ #include #include -#if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) static BlE_SYNC ble_sync_info; void btsnd_hcic_ble_sync_sem_init(void) @@ -63,7 +63,7 @@ void btsnd_hci_ble_set_status(UINT8 hci_status) ble_sync_info.status = hci_status; return; } -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#endif // ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) #if (defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE) @@ -111,7 +111,7 @@ BOOLEAN btsnd_hcic_ble_set_random_addr (BD_ADDR random_bda) return (TRUE); } -BOOLEAN btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, +UINT8 btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, UINT8 addr_type_own, UINT8 addr_type_dir, BD_ADDR direct_bda, UINT8 channel_map, UINT8 adv_filter_policy) @@ -119,7 +119,7 @@ BOOLEAN btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, BT_HDR *p; UINT8 *pp; if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_BLE_WRITE_ADV_PARAMS)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -139,9 +139,9 @@ BOOLEAN btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, UINT8_TO_STREAM (pp, channel_map); UINT8_TO_STREAM (pp, adv_filter_policy); - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } + BOOLEAN btsnd_hcic_ble_read_adv_chnl_tx_power (void) { BT_HDR *p; @@ -164,7 +164,7 @@ BOOLEAN btsnd_hcic_ble_read_adv_chnl_tx_power (void) } -BOOLEAN btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data) +UINT8 btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data) { BT_HDR *p; UINT8 *pp; @@ -174,7 +174,7 @@ BOOLEAN btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data) } if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -197,17 +197,16 @@ BOOLEAN btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data) ARRAY_TO_STREAM (pp, p_data, data_len); } - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } -BOOLEAN btsnd_hcic_ble_set_scan_rsp_data (UINT8 data_len, UINT8 *p_scan_rsp) + +UINT8 btsnd_hcic_ble_set_scan_rsp_data (UINT8 data_len, UINT8 *p_scan_rsp) { BT_HDR *p; UINT8 *pp; if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_BLE_WRITE_SCAN_RSP + 1)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -232,18 +231,16 @@ BOOLEAN btsnd_hcic_ble_set_scan_rsp_data (UINT8 data_len, UINT8 *p_scan_rsp) ARRAY_TO_STREAM (pp, p_scan_rsp, data_len); } - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } -BOOLEAN btsnd_hcic_ble_set_adv_enable (UINT8 adv_enable) +UINT8 btsnd_hcic_ble_set_adv_enable (UINT8 adv_enable) { BT_HDR *p; UINT8 *pp; if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_WRITE_ADV_ENABLE)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -256,10 +253,10 @@ BOOLEAN btsnd_hcic_ble_set_adv_enable (UINT8 adv_enable) UINT8_TO_STREAM (pp, adv_enable); - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } -BOOLEAN btsnd_hcic_ble_set_scan_params (UINT8 scan_type, + +UINT8 btsnd_hcic_ble_set_scan_params (UINT8 scan_type, UINT16 scan_int, UINT16 scan_win, UINT8 addr_type_own, UINT8 scan_filter_policy) { @@ -267,7 +264,7 @@ BOOLEAN btsnd_hcic_ble_set_scan_params (UINT8 scan_type, UINT8 *pp; if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_BLE_WRITE_SCAN_PARAM)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -284,17 +281,16 @@ BOOLEAN btsnd_hcic_ble_set_scan_params (UINT8 scan_type, UINT8_TO_STREAM (pp, addr_type_own); UINT8_TO_STREAM (pp, scan_filter_policy); - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } -BOOLEAN btsnd_hcic_ble_set_scan_enable (UINT8 scan_enable, UINT8 duplicate) +UINT8 btsnd_hcic_ble_set_scan_enable (UINT8 scan_enable, UINT8 duplicate) { BT_HDR *p; UINT8 *pp; if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_BLE_WRITE_SCAN_ENABLE)) == NULL) { - return (FALSE); + return HCI_ERR_MEMORY_FULL; } pp = (UINT8 *)(p + 1); @@ -308,8 +304,7 @@ BOOLEAN btsnd_hcic_ble_set_scan_enable (UINT8 scan_enable, UINT8 duplicate) UINT8_TO_STREAM (pp, scan_enable); UINT8_TO_STREAM (pp, duplicate); - btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p); - return (TRUE); + return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p); } /* link layer connection management commands */ @@ -1103,6 +1098,16 @@ BOOLEAN btsnd_hcic_ble_set_channels (BLE_CHANNELS channels) p->offset = 0; \ } while(0) +/* For UINT8-returning functions that call btu_hcif_send_cmd_sync (return HCI status) */ +#define HCIC_BLE_CMD_CREATED_U8(p, pp, size) do{\ + if ((p = HCI_GET_CMD_BUF(size)) == NULL) { \ + return HCI_ERR_MEMORY_FULL; \ + } \ + pp = p->data; \ + p->len = HCIC_PREAMBLE_SIZE + size;\ + p->offset = 0; \ +} while(0) + #if (BLE_50_FEATURE_SUPPORT == TRUE) BOOLEAN btsnd_hcic_ble_read_phy(UINT16 conn_handle) @@ -1129,7 +1134,7 @@ UINT8 btsnd_hcic_ble_set_prefered_default_phy(UINT8 all_phys, UINT8 *pp; HCI_TRACE_EVENT("%s, all_phys = %d, tx_phys = %d, rx_phys = %d", __func__, all_phys, tx_phys, rx_phys); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_BLE_SET_DEF_PHY); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_BLE_SET_DEF_PHY); UINT16_TO_STREAM(pp, HCI_BLE_SET_DEFAULT_PHY); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_BLE_SET_DEF_PHY); @@ -1217,7 +1222,7 @@ UINT8 btsnd_hcic_ble_set_extend_rand_address(UINT8 adv_handle, BD_ADDR rand_addr UINT8 *pp; HCI_TRACE_EVENT("%s, adv_handle = %d", __func__, adv_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_EXT_RAND_ADDR); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_EXT_RAND_ADDR); UINT16_TO_STREAM (pp, HCI_BLE_SET_ADV_RAND_ADDR); UINT8_TO_STREAM (pp, HCIC_PARAM_SIZE_EXT_RAND_ADDR); @@ -1249,7 +1254,7 @@ UINT8 btsnd_hcic_ble_set_ext_adv_params_v2(UINT8 adv_handle, UINT16 properties, primary_adv_phy, secondary_adv_max_skip, secondary_adv_phy, adv_sid, scan_req_ntf_enable, primary_adv_phy_options, secondary_adv_phy_options); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS + 2); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS + 2); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_ADV_PARAM_V2); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS + 2); @@ -1295,7 +1300,7 @@ UINT8 btsnd_hcic_ble_set_ext_adv_params(UINT8 adv_handle, UINT16 properties, UIN channel_map, own_addr_type, peer_addr_type, adv_filter_policy, adv_tx_power, primary_adv_phy, secondary_adv_max_skip, secondary_adv_phy, adv_sid, scan_req_ntf_enable); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_ADV_PARAM); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_EXT_ADV_SET_PARAMS); @@ -1329,17 +1334,17 @@ UINT8 btsnd_hcic_ble_set_ext_adv_data(UINT8 adv_handle, HCI_TRACE_EVENT("%s, adv_handle = %d, operation = %d, fragment_prefrence = %d,\ data_len = %d", __func__, adv_handle, operation, fragment_prefrence, data_len); - HCIC_BLE_CMD_CREATED(p, pp, data_len + 4); + if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) { + data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA; + } + + HCIC_BLE_CMD_CREATED_U8(p, pp, data_len + 4); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_ADV_DATA); UINT8_TO_STREAM(pp, data_len + 4); UINT8_TO_STREAM(pp, adv_handle); UINT8_TO_STREAM(pp, operation); UINT8_TO_STREAM(pp, fragment_prefrence); - if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) { - data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA; - } - UINT8_TO_STREAM (pp, data_len); if (p_data != NULL && data_len > 0){ @@ -1361,7 +1366,11 @@ UINT8 btsnd_hcic_ble_set_ext_adv_scan_rsp_data(UINT8 adv_handle, HCI_TRACE_EVENT("%s, adv_handle = %d, operation = %d, fragment_prefrence = %d,\n\ data_len = %d", __func__, adv_handle, operation, fragment_prefrence, data_len); - HCIC_BLE_CMD_CREATED(p, pp, data_len + 4); + if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) { + data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA; + } + + HCIC_BLE_CMD_CREATED_U8(p, pp, data_len + 4); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_SCAN_RSP_DATA); UINT8_TO_STREAM(pp, data_len + 4); @@ -1369,12 +1378,6 @@ UINT8 btsnd_hcic_ble_set_ext_adv_scan_rsp_data(UINT8 adv_handle, UINT8_TO_STREAM(pp, operation); UINT8_TO_STREAM(pp, fragment_prefrence); - memset(pp, 0, data_len); - - if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) { - data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA; - } - UINT8_TO_STREAM (pp, data_len); if (p_data != NULL && data_len > 0) { ARRAY_TO_STREAM (pp, p_data, data_len); @@ -1390,7 +1393,7 @@ UINT8 btsnd_hcic_ble_ext_adv_enable(UINT8 enable, UINT8 num_of_sets, UINT8 *adv_ BT_HDR *p; UINT8 *pp; UINT8 ext_adv_size = num_of_sets*4 + 2; - HCIC_BLE_CMD_CREATED(p, pp, ext_adv_size); + HCIC_BLE_CMD_CREATED_U8(p, pp, ext_adv_size); HCI_TRACE_EVENT("%s, enable = %d, num_of_sets = %d", __func__, enable, num_of_sets); @@ -1419,7 +1422,7 @@ UINT8 btsnd_hcic_ble_read_max_adv_len(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_READ_MAX_ADV_SIZE + 1); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_READ_MAX_ADV_SIZE); UINT16_TO_STREAM(pp, HCI_BLE_RD_MAX_ADV_DATA_LEN); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_READ_MAX_ADV_SIZE); @@ -1433,7 +1436,7 @@ UINT8 btsnd_hcic_ble_read_num_support_adv_set(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_NUM_SUPPORT_ADV_SET + 1); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_NUM_SUPPORT_ADV_SET); UINT16_TO_STREAM(pp, HCI_BLE_RD_NUM_OF_ADV_SETS); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_NUM_SUPPORT_ADV_SET); @@ -1447,7 +1450,7 @@ UINT8 btsnd_hcic_ble_remove_adv_set(UINT8 adv_handle) UINT8 *pp; HCI_TRACE_EVENT("%s, adv_handle = %d", __func__, adv_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_REMOVE_ADV_SET + 1); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_REMOVE_ADV_SET); UINT16_TO_STREAM(pp, HCI_BLE_REMOVE_ADV_SET); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_REMOVE_ADV_SET); @@ -1462,7 +1465,7 @@ UINT8 btsnd_hcic_ble_clear_adv_set(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_CLEAR_ADV_SET + 1); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CLEAR_ADV_SET); UINT16_TO_STREAM(pp, HCI_BLE_CLEAR_ADV_SETS); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_CLEAR_ADV_SET); @@ -1483,7 +1486,7 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_params_v2(UINT8 adv_handle, UINT16 interva HCI_TRACE_EVENT("%s, adv_handle = %d, interval_min = %d, interval_max = %d, propertics = %d num_subevents = %d subevent_interval = %d rsp_slot_delay %d rsp_slot_spacing %d num_rsp_slots %d", __func__, adv_handle, interval_min, interval_max, propertics, num_subevents, subevent_interval, rsp_slot_delay, rsp_slot_spacing, num_rsp_slots); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS_V2); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS_V2); UINT16_TO_STREAM(pp, HCI_BLE_SET_PERIOD_ADV_PARAMS_V2); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS_V2); @@ -1513,7 +1516,7 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_params(UINT8 adv_handle, HCI_TRACE_EVENT("%s, adv_handle = %d, interval_min = %d, interval_max = %d, propertics = %d", __func__, adv_handle, interval_min, interval_max, propertics); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS); UINT16_TO_STREAM(pp, HCI_BLE_SET_PERIOD_ADV_PARAMS); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_SET_PERIODIC_ADV_PARAMS); @@ -1540,19 +1543,17 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_data(UINT8 adv_handle, HCI_TRACE_EVENT("%s, adv_handle = %d, operation = %d, len = %d", __func__, adv_handle, operation, len); - HCIC_BLE_CMD_CREATED(p, pp, len + 3); + if (len > HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA) { + len = HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA; + } + + HCIC_BLE_CMD_CREATED_U8(p, pp, len + 3); UINT16_TO_STREAM(pp, HCI_BLE_SET_PERIOD_ADV_DATA); UINT8_TO_STREAM(pp, len + 3); UINT8_TO_STREAM(pp, adv_handle); UINT8_TO_STREAM(pp, operation); - //memset(pp, 0, len); - - if (len > HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA) { - len = HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA; - } - UINT8_TO_STREAM (pp, len); if (p_data != NULL && len > 0) { @@ -1570,7 +1571,7 @@ UINT8 btsnd_hcic_ble_periodic_adv_enable(UINT8 enable, UINT8 adv_handle) HCI_TRACE_EVENT("%s, enable = %d, adv_handle = %d", __func__, enable, adv_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_ENABLE); UINT16_TO_STREAM(pp, HCI_BLE_SET_PERIOD_ADV_ENABLE); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_ENABLE); @@ -1593,7 +1594,7 @@ UINT8 btsnd_hcic_ble_set_ext_scan_params(UINT8 own_addr_type, UINT8 filter_polic __func__, own_addr_type, filter_policy, phy_mask, phy_count); UINT8 params_size = HCIC_PARAM_SIZE_SET_EXT_SCAN_PARAMS + phy_count*5; - HCIC_BLE_CMD_CREATED(p, pp, params_size); + HCIC_BLE_CMD_CREATED_U8(p, pp, params_size); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_SCAN_PARAMS); UINT8_TO_STREAM(pp, params_size); @@ -1619,7 +1620,7 @@ UINT8 btsnd_hcic_ble_ext_scan_enable(UINT8 enable, UINT8 filter_dups, HCI_TRACE_EVENT("%s, enable = %d, filter_dups = %d, duration = %d, period = %d", __func__, enable, filter_dups, duration, period); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_EXT_SCAN_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_EXT_SCAN_ENABLE); UINT16_TO_STREAM(pp, HCI_BLE_SET_EXT_SCAN_ENABLE); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_EXT_SCAN_ENABLE); @@ -1781,15 +1782,16 @@ BOOLEAN btsnd_hcic_ble_create_ext_conn_v2(tHCI_CreatExtConn *p_conn) #if (BLE_50_EXTEND_SYNC_EN == TRUE) BOOLEAN btsnd_hcic_ble_periodic_adv_create_sync(UINT8 option, UINT8 adv_sid, UINT8 adv_addr_type, BD_ADDR adv_addr, + UINT16 skip, UINT16 sync_timeout, UINT8 sync_cte_type) { BT_HDR *p; UINT8 *pp; - HCI_TRACE_EVENT("%s, option = %d, adv_sid = %d, adv_addr_type = %d, sync_timeout = %d, sync_cte_type = %d", - __func__, option, adv_sid, adv_addr_type, sync_timeout, sync_cte_type); + HCI_TRACE_EVENT("%s, option = %d, adv_sid = %d, adv_addr_type = %d, skip = %d, sync_timeout = %d, sync_cte_type = %d", + __func__, option, adv_sid, adv_addr_type, skip, sync_timeout, sync_cte_type); HCI_TRACE_EVENT("addr %02x %02x %02x %02x %02x %02x", adv_addr[0], adv_addr[1], adv_addr[2], adv_addr[3], adv_addr[4], adv_addr[5]); - uint16_t skip = 0; + HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_CREATE_SYNC + 2); UINT16_TO_STREAM(pp, HCI_BLE_PERIOD_ADV_CREATE_SYNC); @@ -1812,7 +1814,7 @@ UINT8 btsnd_hcic_ble_periodic_adv_create_sync_cancel(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_CREATE_SYNC_CANCEL); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_CREATE_SYNC_CANCEL); UINT16_TO_STREAM(pp, HCI_BLE_PERIOD_ADV_CREATE_SYNC_CANCEL); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_CREATE_SYNC_CANCEL); @@ -1826,7 +1828,7 @@ UINT8 btsnd_hcic_ble_periodic_adv_term_sync(UINT16 sync_handle) UINT8 *pp; HCI_TRACE_EVENT("%s, sync_handle = %d", __func__, sync_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_TERM_SYNC); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_TERM_SYNC); UINT16_TO_STREAM(pp, HCI_BLE_PERIOD_ADV_TERM_SYNC); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_TERM_SYNC); @@ -1844,7 +1846,7 @@ UINT8 btsnd_hcic_ble_add_dev_to_periodic_adv_list(UINT8 adv_addr_type, BD_ADDR a HCI_TRACE_EVENT("%s, adv_addr_type = %d, adv_sid = %d", __func__, adv_addr_type, adv_sid); esp_log_buffer_hex_internal("addr", adv_addr, sizeof(BD_ADDR), ESP_LOG_WARN); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ADD_DEV_TO_PERIODIC_ADV_LIST); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ADD_DEV_TO_PERIODIC_ADV_LIST); UINT16_TO_STREAM(pp, HCI_BLE_ADV_DEV_TO_PERIOD_ADV_LIST); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_ADD_DEV_TO_PERIODIC_ADV_LIST); @@ -1863,7 +1865,7 @@ UINT8 btsnd_hcic_ble_rm_dev_from_periodic_adv_list(UINT8 adv_addr_type, BD_ADDR HCI_TRACE_EVENT("%s, adv_addr_type = %d, adv_sid = %d", __func__, adv_addr_type, adv_sid); esp_log_buffer_hex_internal("addr", adv_addr, sizeof(BD_ADDR), ESP_LOG_WARN); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_RM_DEV_FROM_PERIODIC_ADV_LIST); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_RM_DEV_FROM_PERIODIC_ADV_LIST); UINT16_TO_STREAM(pp, HCI_BLE_REMOVE_DEV_FROM_PERIOD_ADV_LIST); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_RM_DEV_FROM_PERIODIC_ADV_LIST); @@ -1881,7 +1883,7 @@ UINT8 btsnd_hcic_ble_clear_periodic_adv_list(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_CLEAR_PERIODIC_ADV_LIST); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CLEAR_PERIODIC_ADV_LIST); UINT16_TO_STREAM(pp, HCI_BLE_CLEAR_PERIOD_ADV_LIST); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_CLEAR_PERIODIC_ADV_LIST); @@ -1895,7 +1897,7 @@ UINT8 btsnd_hcic_ble_read_periodic_adv_list_size(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_READ_PERIODIC_ADV_LIST); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_READ_PERIODIC_ADV_LIST); UINT16_TO_STREAM(pp, HCI_BLE_RD_PERIOD_ADV_LIST_SIZE); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_READ_PERIODIC_ADV_LIST); @@ -1910,7 +1912,7 @@ UINT8 btsnd_hcic_ble_read_trans_power(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_READ_TRANS_POWER); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_READ_TRANS_POWER); UINT16_TO_STREAM(pp, HCI_BLE_RD_TRANSMIT_POWER); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_READ_TRANS_POWER); @@ -1924,7 +1926,7 @@ UINT8 btsnd_hcic_ble_read_rf_path_compensation(void) UINT8 *pp; HCI_TRACE_EVENT("%s", __func__); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_READ_RF_PATH_COMPENSATION); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_READ_RF_PATH_COMPENSATION); UINT16_TO_STREAM(pp, HCI_BLE_RD_RF_PATH_COMPENSATION); UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_READ_RF_PATH_COMPENSATION); @@ -1938,7 +1940,7 @@ UINT8 btsnd_hcic_ble_write_rf_path_compensation(UINT16 rf_tx_path, UINT16 rf_rx_ UINT8 *pp; HCI_TRACE_EVENT("%s, rf_tx_path = %d, rf_rx_path = %d", __func__, rf_tx_path, rf_rx_path); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_WRITE_RF_PATH_COMPENSATION); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_WRITE_RF_PATH_COMPENSATION); pp = (UINT8 *)(p + 1); @@ -1949,7 +1951,7 @@ UINT8 btsnd_hcic_ble_write_rf_path_compensation(UINT16 rf_tx_path, UINT16 rf_rx_ UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_WRITE_RF_PATH_COMPENSATION); UINT16_TO_STREAM(pp, rf_tx_path); - UINT16_TO_STREAM(pp, rf_tx_path); + UINT16_TO_STREAM(pp, rf_rx_path); return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p); } @@ -1961,7 +1963,7 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_recv_enable(UINT16 sync_handle, UINT8 enab BT_HDR *p; UINT8 *pp; - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_RECV_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_RECV_ENABLE); pp = (UINT8 *)(p + 1); @@ -2047,7 +2049,7 @@ UINT8 btsnd_hcic_ble_set_default_periodic_adv_sync_trans_params(UINT8 mode, UINT HCI_TRACE_DEBUG("%s mode %x, skip %x, sync timeout %x", __func__, mode, skip, sync_timeout); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_PAST_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_PAST_PARAMS); pp = (UINT8 *)(p + 1); @@ -2157,7 +2159,7 @@ BOOLEAN btsnd_hcic_ble_set_vendor_evt_mask (UINT32 evt_mask) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) UINT8 btsnd_hcic_ble_big_create(uint8_t big_handle, uint8_t adv_handle, uint8_t num_bis, uint32_t sdu_interval, uint16_t max_sdu, uint16_t max_transport_latency, uint8_t rtn, uint8_t phy, uint8_t packing, uint8_t framing, @@ -2255,7 +2257,7 @@ UINT8 btsnd_hcic_ble_big_terminate(uint8_t big_handle, uint8_t reason) btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p); return TRUE; } -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) UINT8 btsnd_hcic_ble_big_sync_create(uint8_t big_handle, uint16_t sync_handle, uint8_t encryption, uint8_t *bc_code, @@ -2267,17 +2269,19 @@ UINT8 btsnd_hcic_ble_big_sync_create(uint8_t big_handle, uint16_t sync_handle, HCI_TRACE_DEBUG("big sync create: big_handle %d sync_handle %d encryption %d mse %d big_sync_timeout %d", big_handle, sync_handle, encryption, mse, big_sync_timeout); - // for (uint8_t i = 0; i < num_bis; i++) - // { - // HCI_TRACE_ERROR("i %d bis %d", bis[i]); - // } + #define HCIC_PARAM_SIZE_BIG_SYNC_CREATE_FIXED 24 + if (num_bis > (HCIC_PARAM_SIZE_BIG_SYNC_CREATE_PARAMS - HCIC_PARAM_SIZE_BIG_SYNC_CREATE_FIXED)) { + HCI_TRACE_ERROR("%s: num_bis %u exceeds max", __func__, num_bis); + return FALSE; + } - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_BIG_SYNC_CREATE_PARAMS); + UINT8 param_size = HCIC_PARAM_SIZE_BIG_SYNC_CREATE_FIXED + num_bis; + HCIC_BLE_CMD_CREATED(p, pp, param_size); pp = (UINT8 *)(p + 1); UINT16_TO_STREAM(pp, HCI_BLE_BIG_CREATE_SYNC); - UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_BIG_SYNC_CREATE_PARAMS); + UINT8_TO_STREAM(pp, param_size); UINT8_TO_STREAM(pp, big_handle); UINT16_TO_STREAM(pp, sync_handle); @@ -2299,7 +2303,7 @@ UINT8 btsnd_hcic_ble_big_sync_terminate(uint8_t big_handle) HCI_TRACE_DEBUG("%s big_handle %d", __func__, big_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_BIG_SYNC_TERMINATE_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_BIG_SYNC_TERMINATE_PARAMS); pp = (UINT8 *)(p + 1); @@ -2321,7 +2325,7 @@ UINT8 btsnd_hcic_ble_iso_set_data_path(uint16_t conn_handle, uint8_t data_path_d HCI_TRACE_DEBUG("hci set data path: conn_handle %d data_path_dir %d data_path_id %d coding_fmt %d company_id 0x%x vs_codec_id %d controller_delay %ld codec_len %d", conn_handle, data_path_dir, data_path_id, coding_fmt, company_id, vs_codec_id, controller_delay, codec_len); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_SET_DATA_PATH_PARAMS + codec_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_SET_DATA_PATH_PARAMS + codec_len); pp = (UINT8 *)(p + 1); @@ -2350,7 +2354,7 @@ UINT8 btsnd_hcic_ble_iso_remove_data_path(uint16_t conn_handle, uint8_t data_pat HCI_TRACE_DEBUG("hci remove data path: conn_handle %d data_path_dir %d", conn_handle, data_path_dir); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_REMOVE_DATA_PATH_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_REMOVE_DATA_PATH_PARAMS); pp = (UINT8 *)(p + 1); @@ -2370,7 +2374,7 @@ UINT8 btsnd_hcic_ble_iso_read_tx_sync(uint16_t iso_hdl) HCI_TRACE_DEBUG("hci read iso tx sync: iso_hdl %d", iso_hdl); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_READ_TX_SYNC_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_READ_TX_SYNC_PARAMS); pp = (UINT8 *)(p + 1); @@ -2391,7 +2395,7 @@ UINT8 btsnd_hcic_ble_iso_set_cig_params(uint8_t cig_id, uint32_t sdu_int_c_to_p, HCI_TRACE_DEBUG("hci set cig params: cig_id %d sdu_int_c_to_p %d sdu_int_p_to_c %d worse_case_SCA %d packing %d framing %d mtl_c_to_p %d mtl_p_to_c %d cis_cnt %d", cig_id, sdu_int_c_to_p, sdu_int_p_to_c, worse_case_SCA, packing, framing, mtl_c_to_p, mtl_p_to_c, cis_cnt); UINT8 cis_param_len = cis_cnt * 9; - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_SET_CIG_PARAMS + cis_param_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_SET_CIG_PARAMS + cis_param_len); pp = (UINT8 *)(p + 1); @@ -2432,7 +2436,7 @@ UINT8 btsnd_hcic_ble_iso_set_cig_params_test(uint8_t cig_id, uint32_t sdu_int_c_ HCI_TRACE_DEBUG("hci set cig params test: cig_id %d sdu_int_c_to_p %d sdu_int_p_to_c %d ft_c_to_p %d ft_p_to_c %d iso_interval %d worse_case_SCA %d packing %d framing %d cis_cnt %d", cig_id, sdu_int_c_to_p, sdu_int_p_to_c, ft_c_to_p, ft_p_to_c, iso_interval, worse_case_SCA, packing, framing, cis_cnt); UINT8 cis_param_len = cis_cnt * 14; - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_SET_CIG_TEST_PARAMS + cis_param_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_SET_CIG_TEST_PARAMS + cis_param_len); pp = (UINT8 *)(p + 1); @@ -2506,7 +2510,7 @@ UINT8 btsnd_hcic_ble_iso_remove_cig(uint8_t cig_id) HCI_TRACE_DEBUG("hci remove cig: cig_id %d", cig_id); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_REMOVE_CIG_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_REMOVE_CIG_PARAMS); pp = (UINT8 *)(p + 1); @@ -2548,7 +2552,7 @@ UINT8 btsnd_hcic_ble_iso_reject_cis_req(uint16_t cis_handle, uint8_t reason) HCI_TRACE_DEBUG("hci reject cis req: cis_handle %d reason %d", cis_handle, reason); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_REJECT_CIS_REQ_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_REJECT_CIS_REQ_PARAMS); pp = (UINT8 *)(p + 1); @@ -2569,7 +2573,7 @@ UINT8 btsnd_hcic_ble_iso_read_iso_link_quality(uint16_t iso_handle) HCI_TRACE_DEBUG("hci read iso link quality: cis_handle %d", iso_handle); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ISO_READ_LINK_QUALITY_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ISO_READ_LINK_QUALITY_PARAMS); pp = (UINT8 *)(p + 1); @@ -2593,7 +2597,7 @@ UINT8 btsnd_hcic_ble_set_connless_cte_trans_params(uint8_t adv_hdl, uint8_t cte_ HCI_TRACE_DEBUG("hci set connless cte trans: adv_hdl %d cte_len %d cte_type %d cte_cnt %d", adv_hdl, cte_len, cte_type, cte_cnt); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_CTE_TRANS_PARAMS + switching_pattern_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_CTE_TRANS_PARAMS + switching_pattern_len); pp = (UINT8 *)(p + 1); @@ -2620,7 +2624,7 @@ UINT8 btsnd_hcic_ble_set_connless_cte_enable(uint8_t adv_hdl, uint8_t cte_en) HCI_TRACE_DEBUG("hci set connect cte enable: adv_hdl %d cte_en %d", adv_hdl, cte_en); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_CTE_TRANS_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_CTE_TRANS_ENABLE); pp = (UINT8 *)(p + 1); @@ -2641,7 +2645,7 @@ UINT8 btsnd_hcic_ble_set_connless_iq_sampling_enable(uint16_t sync_hdl, uint8_t HCI_TRACE_DEBUG("hci enable IQ sampling: sync_hdl %d sampling_en %d slot_dur %d", sync_hdl, sampling_en, slot_dur); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_IQ_SAMPLING_ENABLE + switching_pattern_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CONNLESS_IQ_SAMPLING_ENABLE + switching_pattern_len); pp = (UINT8 *)(p + 1); @@ -2671,7 +2675,7 @@ UINT8 btsnd_hcic_ble_set_conn_cte_receive_params(uint16_t conn_hdl, uint8_t samp HCI_TRACE_DEBUG("hci set connection cte receive params: conn_hdl %d sampling_en %d slot_dur %d", conn_hdl, sampling_en, slot_dur); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CONN_CTE_RECEIVE_PARAMS + switching_pattern_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CONN_CTE_RECEIVE_PARAMS + switching_pattern_len); pp = (UINT8 *)(p + 1); @@ -2697,7 +2701,7 @@ UINT8 btsnd_hcic_ble_set_conn_cte_trans_params(uint16_t conn_hdl, uint8_t cte_ty HCI_TRACE_DEBUG("hci set connection cte trans params: conn_hdl %d cte_type %d len %d", conn_hdl, cte_type, switching_pattern_len); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CONN_CTE_TRANS_PARAMS + switching_pattern_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CONN_CTE_TRANS_PARAMS + switching_pattern_len); pp = (UINT8 *)(p + 1); @@ -2722,7 +2726,7 @@ UINT8 btsnd_hcic_ble_conn_cte_req_enable(uint16_t conn_hdl, uint8_t enable, uint HCI_TRACE_DEBUG("hci set connect cte request enable: conn_hdl %d enable %d cte_req_int %d req_cte_len %d req_cte_type %d", conn_hdl, enable, cte_req_int, req_cte_len, req_cte_type); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_CONN_CTE_REQ_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CONN_CTE_REQ_ENABLE); pp = (UINT8 *)(p + 1); @@ -2745,7 +2749,7 @@ UINT8 btsnd_hcic_ble_conn_cte_rsp_enable(uint16_t conn_hdl, uint8_t enable) HCI_TRACE_DEBUG("hci set connect cte response enable: conn_hdl %d enable %d", conn_hdl, enable); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_CONN_CTE_RSP_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CONN_CTE_RSP_ENABLE); pp = (UINT8 *)(p + 1); @@ -2766,7 +2770,7 @@ UINT8 btsnd_hcic_ble_read_antenna_info(void) HCI_TRACE_DEBUG("hci read antenna information"); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_READ_ANT_INFO); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_READ_ANT_INFO); pp = (UINT8 *)(p + 1); @@ -2785,7 +2789,7 @@ UINT8 btsnd_hcic_ble_enh_read_trans_power_level(uint16_t conn_handle, uint8_t ph HCI_TRACE_DEBUG("hci enh read trans power level, conn_handle %d phy %d", conn_handle, phy); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_ENH_READ_TRANS_PWR_LEVEL); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_ENH_READ_TRANS_PWR_LEVEL); pp = (UINT8 *)(p + 1); @@ -2829,7 +2833,7 @@ UINT8 btsnd_hcic_ble_set_path_loss_rpt_params(uint16_t conn_handle, uint8_t high conn_handle, high_threshold, high_hysteresis, low_threshold, low_hysteresis, min_time_spent); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PATH_LOSS_REPORTING_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PATH_LOSS_REPORTING_PARAMS); pp = (UINT8 *)(p + 1); @@ -2852,7 +2856,7 @@ UINT8 btsnd_hcic_ble_set_path_loss_rpt_enable(uint16_t conn_handle, uint8_t enab UINT8 *pp; HCI_TRACE_DEBUG("hci set path loss rpt en, conn_handle %d enable %d", conn_handle, enable); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PATH_LOSS_REPORTING_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PATH_LOSS_REPORTING_ENABLE); pp = (UINT8 *)(p + 1); @@ -2871,7 +2875,7 @@ UINT8 btsnd_hcic_ble_set_trans_pwr_rpt_enable(uint16_t conn_handle, uint8_t loca UINT8 *pp; HCI_TRACE_DEBUG("hci set trans power rpt en, conn_handle %d local_enable %d remote_enable %d", conn_handle, local_enable, remote_enable); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_TRANS_PWR_REPORTING_ENABLE); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_TRANS_PWR_REPORTING_ENABLE); pp = (UINT8 *)(p + 1); @@ -2896,7 +2900,7 @@ UINT8 btsnd_hcic_ble_set_default_subrate(UINT16 subrate_min, UINT16 subrate_max, HCI_TRACE_DEBUG("hci set default subrate, subrate_min %d subrate_max %d max_latency %d continuation_number %d supervision_timeout %d", subrate_min, subrate_max, max_latency, continuation_number, supervision_timeout); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_SUBRATE_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_SUBRATE_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -2948,9 +2952,9 @@ UINT8 btsnd_hcic_ble_set_host_feature(uint16_t bit_num, uint8_t bit_val) HCI_TRACE_DEBUG("hci set host feature: bit_num %d bit_val %d", bit_num, bit_val); #if (BLE_FEAT_ISO_60_EN == TRUE) - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_HOST_FEATURE_PARAMS_V2); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_HOST_FEATURE_PARAMS_V2); #else - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_HOST_FEATURE_PARAMS); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_HOST_FEATURE_PARAMS); #endif // #if (BLE_FEAT_ISO_60_EN == TRUE) pp = (UINT8 *)(p + 1); #if (BLE_FEAT_ISO_60_EN == TRUE) @@ -3078,7 +3082,7 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_subevt_data(UINT8 adv_handle, UINT8 num_su param_len += (4 + subevent_params[i].subevent_data_len); } - HCIC_BLE_CMD_CREATED(p, pp, param_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, param_len); pp = (UINT8 *)(p + 1); @@ -3109,7 +3113,7 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_rsp_data(UINT16 sync_handle, UINT16 req_ev HCI_TRACE_DEBUG("hci set PA rsp data, sync_handle %d req_evt %d req_subevt %d rsp_subevt %d rsp_slot %d rsp_data_len %d", sync_handle, req_evt, req_subevt, rsp_subevt, rsp_slot, rsp_data_len); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PA_RESPONSE_DATA_PARAMS_LEN + rsp_data_len); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PA_RESPONSE_DATA_PARAMS_LEN + rsp_data_len); pp = (UINT8 *)(p + 1); @@ -3142,7 +3146,7 @@ UINT8 btsnd_hcic_ble_set_periodic_sync_subevt(UINT16 sync_handle, UINT16 periodi HCI_TRACE_DEBUG("subevt[%d] = %d", i, subevt[i]); } - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PA_SYNC_SUBEVT_PARAMS_LEN + num_subevents_to_sync); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PA_SYNC_SUBEVT_PARAMS_LEN + num_subevents_to_sync); pp = (UINT8 *)(p + 1); @@ -3220,7 +3224,7 @@ UINT8 btsnd_hcic_ble_cs_write_cached_remote_supported_capabilities(UINT16 conn_h NADM_random_capability, cs_sync_phys_supported, subfeatures_supported, T_IP1_times_supported, T_IP2_times_supported, T_FCS_times_supported, T_PM_times_supported, T_SW_times_supported, TX_SNR_capability); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_WRITE_CACHE_REMOTE_SUPP_CAPS_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_WRITE_CACHE_REMOTE_SUPP_CAPS_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -3278,7 +3282,7 @@ UINT8 btsnd_hcic_ble_cs_set_default_settings(UINT16 conn_handle, UINT8 role_enab HCI_TRACE_DEBUG("cs set default settings, conn_handle %d role_enable %d cs_sync_ant_selection %d max_tx_power %d", conn_handle, role_enable, cs_sync_ant_selection, max_tx_power); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_SETTINGS_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_SETTINGS_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -3319,7 +3323,7 @@ UINT8 btsnd_hcic_ble_cs_write_cached_remote_fae_table(UINT16 conn_handle, UINT8 HCI_TRACE_DEBUG("cs write cached remote fae table, conn_handle %d", conn_handle); esp_log_buffer_hex_internal("remote_fae_table", remote_fae_table, 72, ESP_LOG_DEBUG); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_WRITE_CACHED_REMOTE_FAE_TAB_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_WRITE_CACHED_REMOTE_FAE_TAB_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -3407,7 +3411,7 @@ UINT8 btsnd_hcic_ble_cs_set_channel_classification(UINT8 *channel_class) HCI_TRACE_DEBUG("cs set channel class"); esp_log_buffer_hex_internal("channel", channel_class, 10, ESP_LOG_DEBUG); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_CHANNEL_CLASS_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_CHANNEL_CLASS_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -3435,7 +3439,7 @@ UINT8 btsnd_hcic_ble_cs_set_procedure_params(UINT16 conn_handle, UINT8 config_id conn_handle, config_id, max_procedure_len, min_procedure_interval, max_procedure_interval, max_procedure_count, min_subevent_len, max_subevent_len, tone_ant_config_selection, phy, tx_power_delta, preferred_peer_antenna, SNR_control_initiator, SNR_control_reflector); - HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PROCEDURE_PARAMS_LEN); + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_SET_PROCEDURE_PARAMS_LEN); pp = (UINT8 *)(p + 1); @@ -3476,7 +3480,7 @@ UINT8 btsnd_hcic_ble_cs_procedure_enable(UINT16 conn_handle, UINT8 config_id, UI UINT8_TO_STREAM(pp, config_id); UINT8_TO_STREAM(pp, enable); - btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p); + btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p); return TRUE; } diff --git a/components/bt/host/bluedroid/stack/include/stack/bt_types.h b/components/bt/host/bluedroid/stack/include/stack/bt_types.h index 4050b79d3bf..9d59bdda538 100644 --- a/components/bt/host/bluedroid/stack/include/stack/bt_types.h +++ b/components/bt/host/bluedroid/stack/include/stack/bt_types.h @@ -260,6 +260,7 @@ typedef struct { #define STREAM_SKIP_UINT8(p) do { (p) += 1; } while (0) #define STREAM_SKIP_UINT16(p) do { (p) += 2; } while (0) +#define STREAM_SKIP_UINT24(p) do { (p) += 3; } while (0) /******************************************************************************** ** Macros to get and put bytes to and from a field (Little Endian format). diff --git a/components/bt/host/bluedroid/stack/include/stack/btm_api.h b/components/bt/host/bluedroid/stack/include/stack/btm_api.h index 69ed5e27bb8..94a000a976b 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btm_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/btm_api.h @@ -171,23 +171,13 @@ typedef void (tBTM_VSC_CMPL_CB) (tBTM_VSC_CMPL *p1); ** Parameters are the BD Address of remote and the Dev Class of remote. ** If the app returns none zero, the connection or inquiry result will be dropped. */ -typedef UINT8 (tBTM_FILTER_CB) (BD_ADDR bd_addr, DEV_CLASS dc); - -typedef void (tBTM_UPDATE_CONN_PARAM_CBACK) (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDATE_CONN_PRAMS *update_conn_params); - -typedef void (tBTM_SET_PKT_DATA_LENGTH_CBACK) (UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_length_params); +// typedef UINT8 (tBTM_FILTER_CB) (BD_ADDR bd_addr, DEV_CLASS dc); typedef void (tBTM_DTM_CMD_CMPL_CBACK) (void *p1); typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status); -typedef void (tBTM_UPDATE_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration); - -typedef void (tBTM_SET_LOCAL_PRIVACY_CBACK) (UINT8 status); - -typedef void (tBTM_SET_RPA_TIMEOUT_CMPL_CBACK) (UINT8 status); - -typedef void (tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK) (UINT8 status); +// typedef void (tBTM_UPDATE_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration); typedef void (tBTM_BLE_VENDOR_HCI_EVT_CBACK) (UINT8 subevt_code, UINT8 param_len, UINT8 *params); /******************************* @@ -865,16 +855,6 @@ typedef struct { BD_ADDR rem_bda; /* Remote device Bluetooth address */ } tBTM_BLE_CH_MAP_RESULTS; -/* Structure returned with read current TX power event (in tBTM_CMPL_CB callback function) -** in response to BTM_ReadTxPower call. -*/ -typedef struct { - tBTM_STATUS status; - UINT8 hci_status; - INT8 tx_power; - BD_ADDR rem_bda; -} tBTM_TX_POWER_RESULTS; - /* Structure returned with read link quality event (in tBTM_CMPL_CB callback function) ** in response to BTM_ReadLinkQuality call. */ @@ -3177,7 +3157,7 @@ tBTM_STATUS BTM_WriteBredrTxPwrLvl(tBTM_TX_PWR_LVL_TYPE type, INT8 tx_power, tBT ** Returns BTM_CMD_STARTED if successfully initiated or error code ** *******************************************************************************/ -tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb); +tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda); void BTM_BleGetWhiteListSize(uint16_t *length); @@ -4490,7 +4470,7 @@ tBTM_STATUS BTM_SetAfhChannels (AFH_CHANNELS channels, tBTM_CMPL_CB *p_afh_chann ** Returns status of the operation ** *******************************************************************************/ -tBTM_STATUS BTM_BleSetChannels (BLE_CHANNELS channels, tBTM_CMPL_CB *p_ble_channels_cmpl_cback); +tBTM_STATUS BTM_BleSetChannels (BLE_CHANNELS channels); /******************************************************************************* ** diff --git a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h index cff6e3264f4..5ccf477d7bd 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h @@ -867,17 +867,8 @@ typedef void (tBTM_BLE_VERIFY_CBACK)(void *p_ref_data, BOOLEAN match); typedef void (tBTM_BLE_RANDOM_SET_CBACK) (BD_ADDR random_bda); typedef void (tBTM_BLE_SCAN_REQ_CBACK)(BD_ADDR remote_bda, tBLE_ADDR_TYPE addr_type, UINT8 adv_evt); -typedef void (*tBLE_SCAN_PARAM_SETUP_CBACK)(tGATT_IF client_if, tBTM_STATUS status); - -typedef void (tBTM_START_ADV_CMPL_CBACK) (UINT8 status); -typedef void (tBTM_START_STOP_ADV_CMPL_CBACK) (UINT8 status); typedef void (tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTM_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info); -typedef void (tBTM_CLEAR_ADV_CMPL_CBACK) (UINT8 status); -typedef void (tBTM_SET_PRIVACY_MODE_CMPL_CBACK) (tBTM_STATUS status); -typedef void (tBTM_SET_CSA_SUPPORT_CMPL_CBACK) (tBTM_STATUS status); -typedef void (tBTM_SET_VENDOR_EVT_MASK_CBACK) (tBTM_STATUS status); - #if (BLE_50_FEATURE_SUPPORT == TRUE) #define BTM_BLE_5_GAP_READ_PHY_COMPLETE_EVT 1 #define BTM_BLE_5_GAP_SET_PREFERED_DEFAULT_PHY_COMPLETE_EVT 2 @@ -986,10 +977,10 @@ typedef void (tBTM_SET_VENDOR_EVT_MASK_CBACK) (tBTM_STATUS status); typedef UINT8 tBTM_BLE_5_GAP_EVENT; #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #define BTM_BLE_ISO_BIG_CREATE_COMPLETE_EVT 1 #define BTM_BLE_ISO_BIG_TERMINATE_COMPLETE_EVT 2 -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) #define BTM_BLE_ISO_BIG_SYNC_ESTABLISHED_EVT 3 #define BTM_BLE_ISO_BIG_SYNC_LOST_EVT 4 @@ -1107,7 +1098,7 @@ typedef struct { typedef struct { UINT8 status; UINT8 instance_num; - UINT8 instance[10]; + UINT8 instance[MAX_BLE_ADV_INSTANCE]; } tBTM_BLE_EXT_ADV_START_CMPL; typedef struct { @@ -1558,7 +1549,7 @@ typedef struct { #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) #if (BLE_FEAT_ISO_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) typedef struct { UINT8 status; UINT8 big_handle; @@ -1580,7 +1571,7 @@ typedef struct { UINT8 big_handle; UINT8 reason; } tBTM_BLE_BIG_TERMINATE_CMPL; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) typedef struct { @@ -1725,10 +1716,10 @@ typedef struct { typedef union { UINT8 status; -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) tBTM_BLE_BIG_CREATE_CMPL btm_big_cmpl; tBTM_BLE_BIG_TERMINATE_CMPL btm_big_term; -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) tBTM_BLE_BIG_SYNC_ESTAB_CMPL btm_big_sync_estab; tBTM_BLE_BIG_SYNC_LOST_EVT btm_big_sync_lost; @@ -1964,19 +1955,6 @@ extern "C" { #endif */ -/******************************************************************************* -** -** Function BTM_BleRegiseterConnParamCallback -** -** Description register connection parameters update callback func -** -** Parameters: update_conn_param_cb -** -** Returns void -** -*******************************************************************************/ -void BTM_BleRegiseterConnParamCallback(tBTM_UPDATE_CONN_PARAM_CBACK *update_conn_param_cb); -void BTM_BleRegiseterPktLengthChangeCallback(tBTM_SET_PKT_DATA_LENGTH_CBACK *ptk_len_chane_cb); void BTM_BleRegisterVendorHciEventCallback(tBTM_BLE_VENDOR_HCI_EVT_CBACK *vendor_hci_evt_cb); /******************************************************************************* @@ -2021,7 +1999,7 @@ BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, /******************************************************************************* ** -** Function BTM_BleSetAdvParamsAll +** Function BTM_BleStartAdvWithParams ** ** Description This function is called to set all of the advertising parameters. ** @@ -2030,9 +2008,9 @@ BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, ** Returns void ** *******************************************************************************/ -tBTM_STATUS BTM_BleSetAdvParamsAll(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, +tBTM_STATUS BTM_BleStartAdvWithParams(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda, - tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb); + tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp); /******************************************************************************* ** @@ -2103,8 +2081,7 @@ void BTM_BleClearRandAddress(void); ** *******************************************************************************/ tBTM_STATUS BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window, - tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy, - tBLE_SCAN_PARAM_SETUP_CBACK scan_setup_status_cback); + tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy); /******************************************************************************* @@ -2136,22 +2113,6 @@ tBTM_STATUS BTM_BleWriteScanRsp(tBTM_BLE_AD_MASK data_mask, //extern tBTM_STATUS BTM_BleWriteScanRspRaw(UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len); -/******************************************************************************* -** -** Function BTM_BleObserve -** -** Description This procedure keep the device listening for advertising -** events from a broadcast device. -** -** Parameters start: start or stop observe. -** -** Returns void -** -*******************************************************************************/ -//extern -tBTM_STATUS BTM_BleObserve(BOOLEAN start, UINT32 duration, - tBTM_INQ_RESULTS_CB *p_results_cb, tBTM_CMPL_CB *p_cmpl_cb); - /******************************************************************************* ** ** Function BTM_BleScan @@ -2596,17 +2557,17 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, /******************************************************************************* ** -** Function BTM_BleBroadcast +** Function BTM_BleAdvStop ** -** Description This function is to start or stop broadcasting. +** Description This function is to stop broadcasting. ** -** Parameters start: start or stop broadcasting. +** Parameters void ** ** Returns status. ** *******************************************************************************/ //extern -tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback); +tBTM_STATUS BTM_BleAdvStop(void); /******************************************************************************* ** @@ -2621,7 +2582,7 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_st ** *******************************************************************************/ //extern -BOOLEAN BTM_BleConfigPrivacy(BOOLEAN enable, tBTM_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cabck); +BOOLEAN BTM_BleConfigPrivacy(BOOLEAN enable); /******************************************************************************* ** @@ -2737,7 +2698,7 @@ void BTM_BleTurnOnPrivacyOnRemote(BD_ADDR bd_addr, ** *******************************************************************************/ //extern -BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR emote_bda, tBLE_ADDR_TYPE addr_type, tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb); +BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR emote_bda, tBLE_ADDR_TYPE addr_type); /******************************************************************************* ** @@ -2748,7 +2709,7 @@ BOOLEAN BTM_BleUpdateAdvWhitelist(BOOLEAN add_remove, BD_ADDR emote_bda, tBLE_AD ** Returns void ** *******************************************************************************/ -void BTM_BleClearWhitelist(tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb); +void BTM_BleClearWhitelist(void); /******************************************************************************* ** @@ -2940,13 +2901,13 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length); ** Parameters: subcode: add, remove or clean duplicate scan exceptional list. ** type: device info type ** device_info: device information -** update_exceptional_list_cmp_cb: complete callback +** ** ** Returns status ** *******************************************************************************/ -tBTM_STATUS BTM_UpdateBleDuplicateExceptionalList(uint8_t subcode, uint32_t type, BD_ADDR device_info, tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK update_exceptional_list_cmp_cb); +tBTM_STATUS BTM_UpdateBleDuplicateExceptionalList(uint8_t subcode, uint32_t type, BD_ADDR device_info); /******************************************************************************* ** @@ -2981,7 +2942,7 @@ BOOLEAN BTM_Ble_Authorization(BD_ADDR bd_addr, BOOLEAN authorize); ** Parameter p_clear_adv_cback - Command complete callback ** *******************************************************************************/ -BOOLEAN BTM_BleClearAdv(tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback); +BOOLEAN BTM_BleClearAdv(void); /******************************************************************************* ** @@ -2993,7 +2954,7 @@ BOOLEAN BTM_BleClearAdv(tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback); ** Parameter rpa_timeout - The timeout value for RPA, typically in seconds. ** *******************************************************************************/ -BOOLEAN BTM_BleSetRpaTimeout(uint16_t rpa_timeout, tBTM_SET_RPA_TIMEOUT_CMPL_CBACK *p_set_rpa_timeout_cback); +BOOLEAN BTM_BleSetRpaTimeout(uint16_t rpa_timeout); /******************************************************************************* ** @@ -3006,15 +2967,14 @@ BOOLEAN BTM_BleSetRpaTimeout(uint16_t rpa_timeout, tBTM_SET_RPA_TIMEOUT_CMPL_CBA ** Parameters addr - The address of the device to be added to the resolving list. ** addr_type - The address type of the device (public or random). ** irk - The Identity Resolving Key (IRK) of the device. -** p_add_dev_to_resolving_list_callback - Callback function to be called when the operation is completed. +** ** ** Returns TRUE if the operation was successful, otherwise FALSE. ** *******************************************************************************/ BOOLEAN BTM_BleAddDevToResolvingList(BD_ADDR addr, uint8_t addr_type, - uint8_t irk[], - tBTM_ADD_DEV_TO_RESOLVING_LIST_CMPL_CBACK *p_add_dev_to_resolving_list_callback); + uint8_t irk[]); /******************************************************************************* ** @@ -3032,8 +2992,7 @@ BOOLEAN BTM_BleAddDevToResolvingList(BD_ADDR addr, *******************************************************************************/ BOOLEAN BTM_BleSetPrivacyMode(UINT8 addr_type, BD_ADDR bd_addr, - UINT8 privacy_mode, - tBTM_SET_PRIVACY_MODE_CMPL_CBACK *p_callback); + UINT8 privacy_mode); /******************************************************************************* ** @@ -3047,7 +3006,7 @@ BOOLEAN BTM_BleSetPrivacyMode(UINT8 addr_type, ** Returns TRUE if the operation was successful, otherwise FALSE. ** *******************************************************************************/ -BOOLEAN BTM_BleSetCsaSupport (UINT8 csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK *p_callback); +BOOLEAN BTM_BleSetCsaSupport (UINT8 csa_select); /******************************************************************************* ** @@ -3061,7 +3020,7 @@ BOOLEAN BTM_BleSetCsaSupport (UINT8 csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK ** Returns TRUE if the operation was successful, otherwise FALSE. ** *******************************************************************************/ -BOOLEAN BTM_BleSetVendorEventMask(UINT32 evt_mask, tBTM_SET_VENDOR_EVT_MASK_CBACK *p_callback); +BOOLEAN BTM_BleSetVendorEventMask(UINT32 evt_mask); /* #ifdef __cplusplus } @@ -3140,7 +3099,7 @@ void BTM_BleSetPeriodicAdvSyncTransParams(BD_ADDR bd_addr, UINT8 mode, UINT16 sk #if (BLE_FEAT_ISO_EN == TRUE) void BTM_BleIsoRegisterCallback(tBTM_BLE_ISO_CBACK cb); -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) tBTM_STATUS BTM_BleBigCreate(uint8_t big_handle, uint8_t adv_handle, uint8_t num_bis, uint32_t sdu_interval, uint16_t max_sdu, uint16_t max_transport_latency, uint8_t rtn, uint8_t phy, uint8_t packing, uint8_t framing, @@ -3153,7 +3112,7 @@ tBTM_STATUS BTM_BleBigCreateTest(uint8_t big_handle, uint8_t adv_handle, uint8_t uint8_t pto, uint8_t encryption, uint8_t *broadcast_code); tBTM_STATUS BTM_BleBigTerminate(UINT8 big_handle, UINT8 reason); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) tBTM_STATUS BTM_BleBigSyncCreate(uint8_t big_handle, uint16_t sync_handle, uint8_t encryption, uint8_t *bc_code, diff --git a/components/bt/host/bluedroid/stack/include/stack/btu.h b/components/bt/host/bluedroid/stack/include/stack/btu.h index 075adcdd1b3..c2a80916d37 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btu.h +++ b/components/bt/host/bluedroid/stack/include/stack/btu.h @@ -280,9 +280,7 @@ void btu_check_bt_sleep (void); */ void btu_hcif_process_event (UINT8 controller_id, BT_HDR *p_buf); void btu_hcif_send_cmd (UINT8 controller_id, BT_HDR *p_msg); -#if (BLE_50_FEATURE_SUPPORT == TRUE) UINT8 btu_hcif_send_cmd_sync (UINT8 controller_id, BT_HDR *p_buf); -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) void btu_hcif_send_host_rdy_for_data(void); void btu_hcif_cmd_timeout (UINT8 controller_id); diff --git a/components/bt/host/bluedroid/stack/include/stack/hcidefs.h b/components/bt/host/bluedroid/stack/include/stack/hcidefs.h index 15e58ec9239..43eb352bb11 100644 --- a/components/bt/host/bluedroid/stack/include/stack/hcidefs.h +++ b/components/bt/host/bluedroid/stack/include/stack/hcidefs.h @@ -941,10 +941,10 @@ #if (BLE_FEAT_ISO_EN == TRUE) #define HCI_BLE_CIS_ESTABLISHED_V1_EVT 0x19 #define HCI_BLE_CIS_REQUEST_EVT 0x1A -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #define HCI_BLE_BIG_CREATE_COMPLETE_EVT 0x1B #define HCI_BLE_BIG_TERMINATE_COMPLETE_EVT 0x1C -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) #define HCI_BLE_BIG_SYNC_ESTABLISHED_EVT 0x1D #define HCI_BLE_BIG_SYNC_LOST_EVT 0x1E diff --git a/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h b/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h index 1c960ffe458..e82a3178abf 100644 --- a/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h +++ b/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h @@ -799,7 +799,9 @@ void btsnd_hcic_vendor_spec_cmd (BT_HDR *buffer, UINT16 opcode, #define HCIC_PARAM_SIZE_READ_TRANS_POWER 0 #define HCIC_PARAM_SIZE_READ_RF_PATH_COMPENSATION 0 #define HCIC_PARAM_SIZE_WRITE_RF_PATH_COMPENSATION 4 +#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#if ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) BlE_SYNC *btsnd_hcic_ble_get_sync_info(void); void btsnd_hcic_ble_sync_sem_init(void); void btsnd_hcic_ble_sync_sem_deinit(void); @@ -807,7 +809,7 @@ void btsnd_hcic_ble_sync_sem_deinit(void); uint8_t btsnd_hcic_ble_get_status(void); void btsnd_hci_ble_set_status(UINT8 hci_status); -#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) +#endif // ((BLE_50_FEATURE_SUPPORT == TRUE) || (BLE_42_FEATURE_SUPPORT == TRUE)) #if (BLE_FEAT_ADV_MONITOR == TRUE) #define HCIC_PARAM_SIZE_ADD_MONITOR_ADV_LIST 10 @@ -834,25 +836,24 @@ BOOLEAN btsnd_hcic_ble_set_local_used_feat (UINT8 feat_set[8]); BOOLEAN btsnd_hcic_ble_set_random_addr (BD_ADDR random_addr); -BOOLEAN btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, +UINT8 btsnd_hcic_ble_write_adv_params (UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type, UINT8 addr_type_own, UINT8 addr_type_dir, BD_ADDR direct_bda, UINT8 channel_map, UINT8 adv_filter_policy); BOOLEAN btsnd_hcic_ble_read_adv_chnl_tx_power (void); -BOOLEAN btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data); +UINT8 btsnd_hcic_ble_set_adv_data (UINT8 data_len, UINT8 *p_data); -BOOLEAN btsnd_hcic_ble_set_scan_rsp_data (UINT8 data_len, UINT8 *p_scan_rsp); +UINT8 btsnd_hcic_ble_set_scan_rsp_data (UINT8 data_len, UINT8 *p_scan_rsp); -BOOLEAN btsnd_hcic_ble_set_adv_enable (UINT8 adv_enable); +UINT8 btsnd_hcic_ble_set_adv_enable (UINT8 adv_enable); -BOOLEAN btsnd_hcic_ble_set_scan_params (UINT8 scan_type, +UINT8 btsnd_hcic_ble_set_scan_params (UINT8 scan_type, UINT16 scan_int, UINT16 scan_win, UINT8 addr_type, UINT8 scan_filter_policy); -BOOLEAN btsnd_hcic_ble_set_scan_enable (UINT8 scan_enable, UINT8 duplicate); - +UINT8 btsnd_hcic_ble_set_scan_enable (UINT8 scan_enable, UINT8 duplicate); BOOLEAN btsnd_hcic_ble_create_ll_conn (UINT16 scan_int, UINT16 scan_win, UINT8 init_filter_policy, UINT8 addr_type_peer, BD_ADDR bda_peer, UINT8 addr_type_own, UINT16 conn_int_min, UINT16 conn_int_max, UINT16 conn_latency, UINT16 conn_timeout, @@ -1061,6 +1062,7 @@ BOOLEAN btsnd_hcic_ble_create_ext_conn_v2(tHCI_CreatExtConn *p_conn); BOOLEAN btsnd_hcic_ble_periodic_adv_create_sync(UINT8 filter_policy, UINT8 adv_sid, UINT8 adv_addr_type, BD_ADDR adv_addr, + UINT16 skip, UINT16 sync_timeout, UINT8 sync_cte_type); UINT8 btsnd_hcic_ble_periodic_adv_create_sync_cancel(void); @@ -1119,11 +1121,11 @@ UINT8 btsnd_hcic_ble_set_default_periodic_adv_sync_trans_params(UINT8 mode, UINT #define HCIC_PARAM_SIZE_ISO_ACCEPT_CIS_REQ_PARAMS 2 #define HCIC_PARAM_SIZE_ISO_REJECT_CIS_REQ_PARAMS 3 #define HCIC_PARAM_SIZE_ISO_READ_LINK_QUALITY_PARAMS 2 -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #define HCIC_PARAM_SIZE_BIG_CREATE_PARAMS 31 #define HCIC_PARAM_SIZE_BIG_CREATE_TEST_PARAMS 36 #define HCIC_PARAM_SIZE_BIG_TERMINATE_PARAMS 2 -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) #define HCIC_PARAM_SIZE_BIG_SYNC_CREATE_PARAMS 55 #define HCIC_PARAM_SIZE_BIG_SYNC_TERMINATE_PARAMS 1 @@ -1174,7 +1176,7 @@ UINT8 btsnd_hcic_ble_iso_accept_cis_req(uint16_t cis_handle); UINT8 btsnd_hcic_ble_iso_reject_cis_req(uint16_t cis_handle, uint8_t reason); #endif // #if (BLE_FEAT_ISO_CIG_PERIPHERAL_EN == TRUE) -#if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) UINT8 btsnd_hcic_ble_big_create(uint8_t big_handle, uint8_t adv_handle, uint8_t num_bis, uint32_t sdu_interval, uint16_t max_sdu, uint16_t max_transport_latency, uint8_t rtn, uint8_t phy, uint8_t packing, uint8_t framing, @@ -1187,7 +1189,7 @@ UINT8 btsnd_hcic_ble_big_create_test(uint8_t big_handle, uint8_t adv_handle, uin uint8_t pto, uint8_t encryption, uint8_t *broadcast_code); UINT8 btsnd_hcic_ble_big_terminate(uint8_t big_handle, uint8_t reason); -#endif // #if (BLE_FEAT_ISO_BIG_BROCASTER_EN == TRUE) +#endif // #if (BLE_FEAT_ISO_BIG_BROADCASTER_EN == TRUE) #if (BLE_FEAT_ISO_BIG_SYNCER_EN == TRUE) UINT8 btsnd_hcic_ble_big_sync_create(uint8_t big_handle, uint16_t sync_handle, diff --git a/components/bt/host/bluedroid/stack/include/stack/smp_api.h b/components/bt/host/bluedroid/stack/include/stack/smp_api.h index 11d432e716f..f380cf065ad 100644 --- a/components/bt/host/bluedroid/stack/include/stack/smp_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/smp_api.h @@ -48,6 +48,7 @@ #define SMP_OPCODE_MAX SMP_OPCODE_PAIR_KEYPR_NOTIF #define SMP_OPCODE_MIN SMP_OPCODE_PAIRING_REQ #define SMP_OPCODE_PAIR_COMMITM 0x0F +#define SMP_OPCODE_ARRAY_SIZE (SMP_OPCODE_PAIR_COMMITM + 1) // #endif /* SMP event type */ @@ -465,10 +466,10 @@ extern void SMP_SecureConnectionOobDataReply(UINT8 *p_data); ** Description This function is called to encrypt the data with the specified ** key ** -** Parameters: key - Pointer to key key[0] conatins the MSB +** Parameters: key - Pointer to key key[0] contains the MSB ** key_len - key length ** plain_text - Pointer to data to be encrypted -** plain_text[0] conatins the MSB +** plain_text[0] contains the MSB ** pt_len - plain text length ** p_out - pointer to the encrypted outputs ** diff --git a/components/bt/host/bluedroid/stack/l2cap/include/l2c_int.h b/components/bt/host/bluedroid/stack/l2cap/include/l2c_int.h index df956dc4426..cfc51636649 100644 --- a/components/bt/host/bluedroid/stack/l2cap/include/l2c_int.h +++ b/components/bt/host/bluedroid/stack/l2cap/include/l2c_int.h @@ -461,7 +461,7 @@ typedef struct t_l2c_linkcb { */ /* create connection retry count*/ UINT8 retry_create_con; - UINT32 start_time_s; + int64_t start_time_s; #endif #if (L2CAP_ROUND_ROBIN_CHANNEL_SERVICE == TRUE) @@ -736,7 +736,7 @@ extern void l2c_link_timeout (tL2C_LCB *p_lcb); extern void l2c_info_timeout (tL2C_LCB *p_lcb); extern void l2c_link_check_send_pkts (tL2C_LCB *p_lcb, tL2C_CCB *p_ccb, BT_HDR *p_buf); extern void l2c_link_adjust_allocation (void); -extern void l2c_link_process_num_completed_pkts (UINT8 *p); +extern void l2c_link_process_num_completed_pkts (UINT8 *p, UINT8 evt_len); extern void l2c_link_process_num_completed_blocks (UINT8 controller_id, UINT8 *p, UINT16 evt_len); extern void l2c_link_processs_num_bufs (UINT16 num_lm_acl_bufs); extern UINT8 l2c_link_pkts_rcvd (UINT16 *num_pkts, UINT16 *handles); diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_api.c b/components/bt/host/bluedroid/stack/l2cap/l2c_api.c index 07377901a78..c0487f16a5c 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_api.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_api.c @@ -1863,6 +1863,11 @@ UINT16 L2CA_SendFixedChnlData (UINT16 fixed_cid, BD_ADDR rem_bda, BT_HDR *p_buf) BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, BD_ADDR addr) { + if ((fixed_cid < L2CAP_FIRST_FIXED_CHNL) || (fixed_cid > L2CAP_LAST_FIXED_CHNL)) { + L2CAP_TRACE_ERROR ("L2CA_CheckIsCongest() Invalid CID: 0x%04x", fixed_cid); + return TRUE; + } + tL2C_LCB *p_lcb; p_lcb = l2cu_find_lcb_by_bd_addr(addr, BT_TRANSPORT_LE); diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_ble.c b/components/bt/host/bluedroid/stack/l2cap/l2c_ble.c index e0f787c9a19..817d0b94b83 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_ble.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_ble.c @@ -31,6 +31,7 @@ #include "btm_int.h" #include "stack/hcimsgs.h" #include "device/controller.h" +#include "bta_dm_gap.h" #if (BLE_INCLUDED == TRUE) @@ -171,14 +172,18 @@ BOOLEAN L2CA_UpdateBleConnParams (BD_ADDR rem_bda, UINT16 min_int, UINT16 max_in L2CAP_TRACE_ERROR("%s connection parameter update in progress, please try later", __func__); } - if ((need_cb == TRUE) && (conn_callback_func.update_conn_param_cb != NULL)) { - tBTM_LE_UPDATE_CONN_PRAMS update_param; - update_param.max_conn_int = max_int; - update_param.min_conn_int = min_int; - update_param.conn_int = p_lcb->current_used_conn_interval; - update_param.slave_latency = p_lcb->current_used_conn_latency; - update_param.supervision_tout = p_lcb->current_used_conn_timeout; - (conn_callback_func.update_conn_param_cb)(status, p_lcb->remote_bd_addr, &update_param); + if (need_cb) { + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.conn_params_update.status = status; + memcpy(cb_params.conn_params_update.remote_bd_addr, p_lcb->remote_bd_addr, BD_ADDR_LEN); + cb_params.conn_params_update.min_conn_int = min_int; + cb_params.conn_params_update.max_conn_int = max_int; + cb_params.conn_params_update.conn_int = p_lcb->current_used_conn_interval; + cb_params.conn_params_update.slave_latency = p_lcb->current_used_conn_latency; + cb_params.conn_params_update.supervision_tout = p_lcb->current_used_conn_timeout; + + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_CONNECTION_PARAMS_UPDATE_EVT, &cb_params); + return (status == HCI_SUCCESS); } @@ -234,6 +239,7 @@ BOOLEAN L2CA_EnableUpdateBleConnParams (BD_ADDR rem_bda, BOOLEAN enable) return (FALSE); } bool is_disable = (p_lcb->conn_update_mask & L2C_BLE_CONN_UPDATE_DISABLE); + // for multiple links, actively updating the parameters to 7.5ms may degrade multi-connection performance if(l2cu_ble_plcb_active_count() >1 && !(enable && is_disable)) { return FALSE; } @@ -646,9 +652,8 @@ void l2cble_process_conn_update_evt (UINT16 handle, UINT8 status, UINT16 conn_in p_lcb->conn_update_mask &= ~L2C_BLE_UPDATE_PARAM_FULL; btu_stop_timer(&p_lcb->upda_con_timer); - if (conn_callback_func.update_conn_param_cb != NULL) { - l2c_send_update_conn_params_cb(p_lcb, status); - } + + l2c_send_update_conn_params_cb(p_lcb, status); if (l2cble_start_conn_update(p_lcb) == TRUE) { UINT32 time = CalConnectParamTimeout(p_lcb); @@ -685,9 +690,8 @@ void l2cble_get_conn_param_format_err_from_contoller (UINT8 status, UINT16 handl btu_stop_timer (&p_lcb->upda_con_timer); - if (conn_callback_func.update_conn_param_cb != NULL) { - l2c_send_update_conn_params_cb(p_lcb, status); - } + l2c_send_update_conn_params_cb(p_lcb, status); + if ((p_lcb->conn_update_mask & L2C_BLE_UPDATE_PARAM_FULL) != 0){ p_lcb->conn_update_mask &= ~L2C_BLE_UPDATE_PARAM_FULL; if (l2cble_start_conn_update(p_lcb) == TRUE) { @@ -827,7 +831,6 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) STREAM_TO_UINT16(mps, p); STREAM_TO_UINT16(credits, p); L2CAP_TRACE_DEBUG("%s spsm %x, scid %x", __func__, spsm, scid); - UNUSED(spsm); p_ccb = l2cu_find_ccb_by_remote_cid(p_lcb, scid); if (p_ccb) { @@ -835,12 +838,11 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) break; } - #if 0 p_rcb = l2cu_find_ble_rcb_by_psm(spsm); if (p_rcb == NULL) { + l2cu_reject_ble_connection(p_lcb, id, L2CAP_LE_RESULT_NO_PSM); break; } - #endif p_ccb = l2cu_allocate_ccb(p_lcb, 0); if (p_ccb == NULL) { @@ -861,6 +863,34 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) l2cu_send_peer_ble_credit_based_conn_res(p_ccb, L2CAP_LE_RESULT_CONN_OK); break; } + case L2CAP_CMD_BLE_FLOW_CTRL_CREDIT: { + if (cmd_len < L2CAP_CMD_BLE_FLOW_CTRL_CREDIT_LEN) { + L2CAP_TRACE_WARNING ("L2CAP - LE - flow ctrl credit too short: %d", cmd_len); + return; + } + tL2C_CCB *p_ccb = NULL; + UINT16 lcid; + UINT16 credit; + STREAM_TO_UINT16(lcid, p); + STREAM_TO_UINT16(credit, p); + + p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid); + if (p_ccb == NULL) { + L2CAP_TRACE_WARNING ("L2CAP - LE - flow ctrl credit for unknown CID: 0x%04x", lcid); + break; + } + + if ((p_ccb->peer_conn_cfg.credits + credit) > L2CAP_LE_MAX_CREDIT) { + L2CAP_TRACE_WARNING ("L2CAP - LE - credit overflow, disconnecting CID: 0x%04x", lcid); + l2cble_send_peer_disc_req(p_ccb); + } else { + p_ccb->peer_conn_cfg.credits += credit; + L2CAP_TRACE_DEBUG ("L2CAP - LE - credits updated to %d for CID: 0x%04x", + p_ccb->peer_conn_cfg.credits, lcid); + l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, NULL); + } + break; + } case L2CAP_CMD_DISC_REQ: { if (cmd_len < 4) { L2CAP_TRACE_WARNING ("L2CAP - LE - short cmd: %d", cmd_len); @@ -875,10 +905,11 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid); if (p_ccb) { p_ccb->remote_id = id; - // TODO + l2cu_send_peer_disc_rsp(p_lcb, id, lcid, rcid); + } else { + L2CAP_TRACE_WARNING ("L2CAP - LE - disc req with invalid lcid, send cmd reject"); + l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_INVALID_CID, id, rcid, lcid); } - - l2cu_send_peer_disc_rsp(p_lcb, id, lcid, rcid); break; } default: @@ -986,13 +1017,20 @@ BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb) uint32_t link_timeout = L2CAP_BLE_LINK_CONNECT_TOUT; if(GATTC_CONNECT_RETRY_COUNT) { if(!p_lcb->retry_create_con) { - p_lcb->start_time_s = (esp_system_get_time()/1000); + p_lcb->start_time_s = esp_system_get_time() / 1000; } - uint32_t current_time = (esp_system_get_time()/1000); - link_timeout = (L2CAP_BLE_LINK_CONNECT_TOUT*1000 - (current_time - p_lcb->start_time_s))/1000; + int64_t current_time = esp_system_get_time() / 1000; + int64_t elapsed_ms = current_time - p_lcb->start_time_s; + int64_t timeout_ms = (int64_t)L2CAP_BLE_LINK_CONNECT_TOUT * 1000; + int64_t remaining_ms = timeout_ms - elapsed_ms; - if(link_timeout == 0 || link_timeout > L2CAP_BLE_LINK_CONNECT_TOUT) { + if (remaining_ms <= 0 || remaining_ms > timeout_ms) { link_timeout = L2CAP_BLE_LINK_CONNECT_TOUT; + } else { + link_timeout = (uint32_t)(remaining_ms / 1000); + if (link_timeout == 0) { + link_timeout = 1; + } } } @@ -1073,19 +1111,29 @@ BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb) #if (BT_BLE_FEAT_PAWR_EN == TRUE) if (p_lcb->is_pawr_synced) { if(!btsnd_hcic_ble_create_ext_conn_v2(&aux_conn)) { + l2cb.is_ble_connecting = FALSE; + memset(l2cb.ble_connecting_bda, 0, BD_ADDR_LEN); + btm_ble_set_conn_st (BLE_CONN_IDLE); l2cu_release_lcb (p_lcb); L2CAP_TRACE_ERROR("initiate pawr sync connection failed, no resources"); + return (FALSE); } } else #endif // (BT_BLE_FEAT_PAWR_EN == TRUE) { if(!btsnd_hcic_ble_create_ext_conn(&aux_conn)) { + l2cb.is_ble_connecting = FALSE; + memset(l2cb.ble_connecting_bda, 0, BD_ADDR_LEN); + btm_ble_set_conn_st (BLE_CONN_IDLE); l2cu_release_lcb (p_lcb); L2CAP_TRACE_ERROR("initiate Aux connection failed, no resources"); + return (FALSE); } } #else + l2cu_release_lcb (p_lcb); L2CAP_TRACE_ERROR("BLE 5.0 not support!\n"); + return (FALSE); #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) return (TRUE); } @@ -1293,7 +1341,7 @@ void l2cble_process_rc_param_request_evt(UINT16 handle, UINT16 int_min, UINT16 i btsnd_hcic_ble_rc_param_req_reply(handle, int_min, int_max, latency, timeout, BLE_CE_LEN_MIN, BLE_CE_LEN_MIN); }else { L2CAP_TRACE_EVENT ("L2CAP - LE - update currently disabled"); - p_lcb->conn_update_mask |= L2C_BLE_NEW_CONN_PARAM; + // p_lcb->conn_update_mask |= L2C_BLE_NEW_CONN_PARAM; btsnd_hcic_ble_rc_param_req_neg_reply (handle, HCI_ERR_UNACCEPT_CONN_INTERVAL); } } @@ -1374,23 +1422,24 @@ void l2cble_process_data_length_change_event(UINT16 handle, UINT16 tx_data_len, if(p_acl) { p_acl->data_length_params = data_length_params; - if (p_acl->p_set_pkt_data_cback) { - // Only when the corresponding API is called will the callback be registered - (*p_acl->p_set_pkt_data_cback)(BTM_SUCCESS, &data_length_params); - } else { - // If the callback is not registered,using global callback - (*conn_callback_func.set_pkt_data_length_cb)(BTM_SUCCESS, &data_length_params); - } + + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.data_length_params.status = BTM_SUCCESS; + cb_params.data_length_params.rx_len = data_length_params.rx_len; + cb_params.data_length_params.tx_len = data_length_params.tx_len; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT, &cb_params); + p_acl->data_len_updating = false; if(p_acl->data_len_waiting) { p_acl->data_len_waiting = false; - p_acl->p_set_pkt_data_cback = p_acl->p_set_data_len_cback_waiting; - p_acl->p_set_data_len_cback_waiting = NULL; // if value is same, trigger callback directly if(p_acl->tx_len_waiting == p_acl->data_length_params.tx_len) { - if(p_acl->p_set_pkt_data_cback) { - (*p_acl->p_set_pkt_data_cback)(BTM_SUCCESS, &p_acl->data_length_params); - } + + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + cb_params.data_length_params.status = BTM_SUCCESS; + cb_params.data_length_params.rx_len = data_length_params.rx_len; + cb_params.data_length_params.tx_len = data_length_params.tx_len; + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_DATA_LEN_SET_COMPLETE_EVT, &cb_params); return; } p_acl->data_len_updating = true; @@ -1450,24 +1499,26 @@ void l2cble_set_fixed_channel_tx_data_length(BD_ADDR remote_bda, UINT16 fix_cid, *******************************************************************************/ void l2c_send_update_conn_params_cb(tL2C_LCB *p_lcb, UINT8 status) { - if(conn_callback_func.update_conn_param_cb != NULL){ - tBTM_LE_UPDATE_CONN_PRAMS update_param; - //if myself update the connection parameters - if (p_lcb->updating_param_flag){ - update_param.max_conn_int = p_lcb->updating_conn_max_interval; - update_param.min_conn_int = p_lcb->updating_conn_min_interval; - p_lcb->updating_param_flag = false; - }else{ - // remote device update the connection parameters - update_param.max_conn_int = update_param.min_conn_int = 0; - } - // current connection parameters - update_param.conn_int = p_lcb->current_used_conn_interval; - update_param.slave_latency = p_lcb->current_used_conn_latency; - update_param.supervision_tout = p_lcb->current_used_conn_timeout; - - (conn_callback_func.update_conn_param_cb)(status, p_lcb->remote_bd_addr, &update_param); + tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params = {0}; + //if myself update the connection parameters + if (p_lcb->updating_param_flag){ + cb_params.conn_params_update.max_conn_int = p_lcb->updating_conn_max_interval; + cb_params.conn_params_update.min_conn_int = p_lcb->updating_conn_min_interval; + p_lcb->updating_param_flag = false; + }else{ + // remote device update the connection parameters + cb_params.conn_params_update.max_conn_int = cb_params.conn_params_update.min_conn_int = 0; } + // current connection parameters + cb_params.conn_params_update.conn_int = p_lcb->current_used_conn_interval; + cb_params.conn_params_update.slave_latency = p_lcb->current_used_conn_latency; + cb_params.conn_params_update.supervision_tout = p_lcb->current_used_conn_timeout; + + + cb_params.conn_params_update.status = status; + memcpy(cb_params.conn_params_update.remote_bd_addr, p_lcb->remote_bd_addr, BD_ADDR_LEN); + + BTM_LegacyBleCallbackTrigger(BTM_BLE_LEGACY_GAP_CONNECTION_PARAMS_UPDATE_EVT, &cb_params); } /******************************************************************************* diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_link.c b/components/bt/host/bluedroid/stack/l2cap/l2c_link.c index a51c4e84278..347e220a41a 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_link.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_link.c @@ -43,7 +43,7 @@ static BOOLEAN l2c_link_send_to_lower (tL2C_LCB *p_lcb, BT_HDR *p_buf); #if (BLE_50_FEATURE_SUPPORT == TRUE) -extern tBTM_STATUS BTM_BleStartExtAdvRestart(uint8_t handle); +extern tBTM_STATUS BTM_BleStartExtAdvRestart(uint16_t handle); #endif// #if (BLE_50_FEATURE_SUPPORT == TRUE) extern bool btm_ble_inter_get(void); @@ -379,6 +379,9 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason) } else { #if (BLE_INCLUDED == TRUE) tL2C_LINK_STATE link_state_temp = p_lcb->link_state; +#if ((BLE_42_ADV_EN == TRUE) || (GATTC_CONNECT_RETRY_EN == TRUE) || (BLE_50_EXTEND_ADV_EN == TRUE)) + UINT8 link_role_temp = p_lcb->link_role; +#endif #endif // (BLE_INCLUDED == TRUE) /* There can be a case when we rejected PIN code authentication */ /* otherwise save a new reason */ @@ -469,6 +472,7 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason) } #endif } + /* l2cu_create_conn must not release the LCB on failure */ if (l2cu_create_conn(p_lcb, transport)) { lcb_is_free = FALSE; /* still using this lcb */ } @@ -476,13 +480,15 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason) p_lcb->p_pending_ccb = NULL; #if (BLE_INCLUDED == TRUE) - if(p_lcb->transport == BT_TRANSPORT_LE) { + /* Use p_lcb->transport so BLE reconnection (slave adv restart / master retry) runs even when + * there was no pending CCB; 'transport' is only set when (p_first_ccb || p_pending_ccb). */ + if (p_lcb->transport == BT_TRANSPORT_LE) { // for legacy adv, adv restart in gatt_le_connect_cback->gatt_cleanup_upon_disc->BTM_Recovery_Pre_State if (reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT) { #if (BLE_42_FEATURE_SUPPORT == TRUE) #if (BLE_42_ADV_EN == TRUE) - if(!btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) { + if(!btm_ble_inter_get() && link_role_temp == HCI_ROLE_SLAVE) { L2CAP_TRACE_DEBUG("slave resatrt adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason); tBTM_STATUS start_adv_status = btm_ble_start_adv(); if (start_adv_status != BTM_SUCCESS) { @@ -496,7 +502,7 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason) if ((reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT) || (link_state_temp == LST_CONNECTING)) { #if (GATTC_CONNECT_RETRY_EN == TRUE) - if(p_lcb->link_role == HCI_ROLE_MASTER && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) { + if(link_role_temp == HCI_ROLE_MASTER && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) { L2CAP_TRACE_DEBUG("master retry connect, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason); p_lcb->retry_create_con ++; // create connection retry @@ -513,7 +519,7 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason) if ((reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT) || (link_state_temp == LST_DISCONNECTED)) { #if (BLE_50_FEATURE_SUPPORT == TRUE) #if (BLE_50_EXTEND_ADV_EN == TRUE) - if(btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) { + if(btm_ble_inter_get() && link_role_temp == HCI_ROLE_SLAVE) { L2CAP_TRACE_DEBUG("slave restart extend adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason); tBTM_STATUS start_adv_status = BTM_BleStartExtAdvRestart(handle); if (start_adv_status != BTM_SUCCESS) { @@ -626,6 +632,7 @@ void l2c_link_timeout (tL2C_LCB *p_lcb) #endif /* Release the LCB */ l2cu_release_lcb (p_lcb); + return; } /* If link is connected, check for inactivity timeout */ @@ -1314,6 +1321,13 @@ static BOOLEAN l2c_link_send_to_lower (tL2C_LCB *p_lcb, BT_HDR *p_buf) acl_data_size = controller->get_acl_data_size_classic(); xmit_window = l2cb.controller_xmit_window; } + + if (p_buf->len <= HCI_DATA_PREAMBLE_SIZE) { + L2CAP_TRACE_ERROR ("l2c_link_send_to_lower - bad buffer len: %u", p_buf->len); + osi_free(p_buf); + return FALSE; + } + num_segs = (p_buf->len - HCI_DATA_PREAMBLE_SIZE + acl_data_size - 1) / acl_data_size; @@ -1395,15 +1409,26 @@ static BOOLEAN l2c_link_send_to_lower (tL2C_LCB *p_lcb, BT_HDR *p_buf) ** Returns void ** *******************************************************************************/ -void l2c_link_process_num_completed_pkts (UINT8 *p) +void l2c_link_process_num_completed_pkts (UINT8 *p, UINT8 evt_len) { UINT8 num_handles, xx; UINT16 handle; UINT16 num_sent; tL2C_LCB *p_lcb; + if (evt_len < 1) { + L2CAP_TRACE_ERROR ("l2c_link_process_num_completed_pkts: evt too short (len=%u)", evt_len); + return; + } + STREAM_TO_UINT8 (num_handles, p); + if (num_handles > (evt_len - 1) / 4) { + L2CAP_TRACE_ERROR ("l2c_link_process_num_completed_pkts: num_handles %u exceeds evt_len %u, truncating", + num_handles, evt_len); + num_handles = (evt_len - 1) / 4; + } + for (xx = 0; xx < num_handles; xx++) { STREAM_TO_UINT16 (handle, p); STREAM_TO_UINT16 (num_sent, p); diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_main.c b/components/bt/host/bluedroid/stack/l2cap/l2c_main.c index d5d6b91dbba..1a58b69277a 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_main.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_main.c @@ -150,7 +150,6 @@ void l2c_rcv_acl_data (BT_HDR *p_msg) #if (!CONFIG_BT_STACK_NO_LOG) UINT16 psm; #endif - UINT16 credit; /* Extract the handle */ STREAM_TO_UINT16 (handle, p); @@ -292,6 +291,9 @@ void l2c_rcv_acl_data (BT_HDR *p_msg) if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_BASIC_MODE) { #if (CLASSIC_BT_INCLUDED == TRUE) l2c_fcr_proc_pdu (p_ccb, p_msg); +#else + /* Classic FCR not compiled (e.g. BLE-only); free p_msg to avoid leak */ + osi_free (p_msg); #endif ///CLASSIC_BT_INCLUDED == TRUE } else { (*l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb) @@ -310,31 +312,24 @@ void l2c_rcv_acl_data (BT_HDR *p_msg) osi_free (p_msg); } else { if (p_lcb->transport == BT_TRANSPORT_LE) { - // Got a pkt, valid send out credits to the peer device - credit = L2CAP_LE_DEFAULT_CREDIT; - L2CAP_TRACE_DEBUG("%s Credits received %d",__func__, credit); - if((p_ccb->peer_conn_cfg.credits + credit) > L2CAP_LE_MAX_CREDIT) { - /* we have received credits more than max coc credits, - * so disconnecting the Le Coc Channel - */ -#if (BLE_INCLUDED == TRUE) - l2cble_send_peer_disc_req (p_ccb); -#endif ///BLE_INCLUDED == TRUE - } else { - p_ccb->peer_conn_cfg.credits += credit; - l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL); - } + l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL); } /* Basic mode packets go straight to the state machine */ if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE) { -#if (CLASSIC_BT_INCLUDED == TRUE) +#if (L2CAP_COC_INCLUDED == TRUE) l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_msg); -#endif ///CLASSIC_BT_INCLUDED == TRUE +#else + /* COC not included: state machine not compiled; free p_msg to avoid leak */ + osi_free (p_msg); +#endif } else { /* eRTM or streaming mode, so we need to validate states first */ if ((p_ccb->chnl_state == CST_OPEN) || (p_ccb->chnl_state == CST_CONFIG)) { #if (CLASSIC_BT_INCLUDED == TRUE) l2c_fcr_proc_pdu (p_ccb, p_msg); +#else + /* Classic FCR not compiled (e.g. BLE-only); free p_msg to avoid leak */ + osi_free (p_msg); #endif ///CLASSIC_BT_INCLUDED == TRUE } else { osi_free (p_msg); @@ -423,14 +418,26 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) switch (cmd_code) { case L2CAP_CMD_REJECT: + if (cmd_len < L2CAP_CMD_REJECT_LEN) { + L2CAP_TRACE_WARNING ("L2CAP - cmd reject too short, cmd_len: %d", cmd_len); + break; + } STREAM_TO_UINT16 (rej_reason, p); if (rej_reason == L2CAP_CMD_REJ_MTU_EXCEEDED) { + if (cmd_len < L2CAP_CMD_REJECT_LEN + 2) { + L2CAP_TRACE_WARNING ("L2CAP - MTU rej too short, cmd_len: %d", cmd_len); + break; + } STREAM_TO_UINT16 (rej_mtu, p); /* What to do with the MTU reject ? We have negotiated an MTU. For now */ /* we will ignore it and let a higher protocol timeout take care of it */ L2CAP_TRACE_WARNING ("L2CAP - MTU rej Handle: %d MTU: %d", p_lcb->handle, rej_mtu); } if (rej_reason == L2CAP_CMD_REJ_INVALID_CID) { + if (cmd_len < L2CAP_CMD_REJECT_LEN + 4) { + L2CAP_TRACE_WARNING ("L2CAP - CID rej too short, cmd_len: %d", cmd_len); + break; + } STREAM_TO_UINT16 (rcid, p); STREAM_TO_UINT16 (lcid, p); @@ -909,7 +916,7 @@ void l2c_init (void) l2cb.l2c_ble_fixed_chnls_mask = L2CAP_FIXED_CHNL_ATT_BIT | L2CAP_FIXED_CHNL_BLE_SIG_BIT | L2CAP_FIXED_CHNL_SMP_BIT; #endif - + // Free callback must be NULL l2cb.rcv_pending_q = list_new(NULL); if (l2cb.rcv_pending_q == NULL) { L2CAP_TRACE_ERROR("%s unable to allocate memory for link layer control block", __func__); @@ -948,6 +955,10 @@ void l2c_free_p_ccb_pool(void) void l2c_free(void) { + // check again + if (l2cb.rcv_pending_q && list_length(l2cb.rcv_pending_q) > 0) { + assert(0); + } list_free(l2cb.rcv_pending_q); l2cb.rcv_pending_q = NULL; l2c_free_p_lcb_pool(); diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c b/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c index de1faec7493..ad996c18da9 100644 --- a/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c +++ b/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c @@ -170,6 +170,10 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb) p_lcb->start_time_s = 0; #endif // #if (BLE_INCLUDED == TRUE) +#if (BT_BLE_FEAT_PAWR_EN == TRUE) + p_lcb->is_pawr_synced = FALSE; +#endif + /* Stop and release timers */ btu_free_timer (&p_lcb->timer_entry); memset(&p_lcb->timer_entry, 0, sizeof(TIMER_LIST_ENT)); @@ -364,10 +368,7 @@ uint8_t l2cu_ble_plcb_active_count(void) active_count ++; } } - if (active_count >= MAX_L2CAP_CHANNELS) { - L2CAP_TRACE_ERROR("error active count"); - active_count = 0; - } + L2CAP_TRACE_DEBUG("plcb active count %d", active_count); return active_count; @@ -1898,15 +1899,31 @@ void l2cu_disconnect_chnl (tL2C_CCB *p_ccb) UINT16 local_cid = p_ccb->local_cid; if (local_cid >= L2CAP_BASE_APPL_CID) { - tL2CA_DISCONNECT_IND_CB *p_disc_cb = p_ccb->p_rcb->api.pL2CA_DisconnectInd_Cb; + tL2CA_DISCONNECT_IND_CB *p_disc_cb = NULL; + + if (p_ccb->p_rcb != NULL) { + p_disc_cb = p_ccb->p_rcb->api.pL2CA_DisconnectInd_Cb; + } L2CAP_TRACE_WARNING ("L2CAP - disconnect_chnl CID: 0x%04x", local_cid); l2cu_send_peer_disc_req (p_ccb); + /* + * l2cu_send_peer_disc_req drains xmit_hold_q in basic FCR mode. + * Free the queue and NULL it here to prevent l2cu_release_ccb from + * calling fixed_queue_free again on already-dequeued buffers. + */ + if (p_ccb->xmit_hold_q != NULL) { + fixed_queue_free(p_ccb->xmit_hold_q, osi_free_func); + p_ccb->xmit_hold_q = NULL; + } + l2cu_release_ccb (p_ccb); - (*p_disc_cb)(local_cid, FALSE); + if (p_disc_cb) { + (*p_disc_cb)(local_cid, FALSE); + } } else { /* failure on the AMP channel, probably need to disconnect ACL */ L2CAP_TRACE_ERROR ("L2CAP - disconnect_chnl CID: 0x%04x Ignored", local_cid); @@ -3286,7 +3303,7 @@ tL2C_LCB *l2cu_find_lcb_by_handle (UINT16 handle) bool l2cu_find_ccb_in_list(void *p_ccb_node, void *p_local_cid) { tL2C_CCB *p_ccb = (tL2C_CCB *)p_ccb_node; - uint8_t local_cid = *((uint8_t *)p_local_cid); + uint16_t local_cid = *((uint16_t *)p_local_cid); if (p_ccb->local_cid == local_cid && p_ccb->in_use) { return FALSE; diff --git a/components/bt/host/bluedroid/stack/smp/include/smp_int.h b/components/bt/host/bluedroid/stack/smp/include/smp_int.h index ca2dbfaf07b..0c0ac676bed 100644 --- a/components/bt/host/bluedroid/stack/smp/include/smp_int.h +++ b/components/bt/host/bluedroid/stack/smp/include/smp_int.h @@ -510,7 +510,7 @@ extern void smp_generate_passkey (tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_generate_rand_cont(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_create_private_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); extern void smp_use_oob_private_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); -extern void smp_compute_dhkey(tSMP_CB *p_cb); +extern BOOLEAN smp_compute_dhkey(tSMP_CB *p_cb); extern void smp_calculate_local_commitment(tSMP_CB *p_cb); extern void smp_calculate_peer_commitment(tSMP_CB *p_cb, BT_OCTET16 output_buf); extern void smp_calculate_numeric_comparison_display_number(tSMP_CB *p_cb, tSMP_INT_DATA *p_data); diff --git a/components/bt/host/bluedroid/stack/smp/p_256_ecc_pp.c b/components/bt/host/bluedroid/stack/smp/p_256_ecc_pp.c index d3b9452c1e9..f4a1b883d4f 100644 --- a/components/bt/host/bluedroid/stack/smp/p_256_ecc_pp.c +++ b/components/bt/host/bluedroid/stack/smp/p_256_ecc_pp.c @@ -177,9 +177,16 @@ static void ECC_NAF(uint8_t *naf, uint32_t *NumNAF, DWORD *k, uint32_t keyLength k[0] = k[0] + 1; if (k[0] == 0) { //overflow j = 1; - do { + while (j < keyLength && k[j] == 0xFFFFFFFF) { + k[j] = 0; + j++; + } + if (j < keyLength) { k[j]++; - } while (k[j++] == 0); //overflow + } + // If j >= keyLength, the entire key is 0xFFFFFFFF, + // which should not happen for a valid private key. + // In this case, we stop the propagation to prevent buffer overflow. } } } else { @@ -267,7 +274,9 @@ bool ECC_CheckPointIsInElliCur_P256(Point *p) /* The function of the elliptic curve is y^2 = x^3 - 3x + b (mod q) ==> y^2 = (x^2 - 3)*x + b (mod q), so we calculate the x^2 - 3 value here */ - x_x[0] -= 3; + DWORD three[2 * KEY_LENGTH_DWORDS_P256] = {0}; + three[0] = 3; + multiprecision_sub(x_x, x_x, three, 2 * KEY_LENGTH_DWORDS_P256); /* Using math relations. (a*b) % q = ((a%q)*(b%q)) % q ==> (x^2 - 3)*x = (((x^2 - 3) % q) * x % q) % q */ multiprecision_fast_mod_P256(x_x_q, x_x); diff --git a/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c b/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c index 92291d98b38..d0a45a247c6 100644 --- a/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c +++ b/components/bt/host/bluedroid/stack/smp/p_256_multprecision.c @@ -262,7 +262,7 @@ void multiprecision_mult(DWORD *c, DWORD *a, DWORD *b, uint32_t keyLength) DWORD V; U = V = W = 0; - multiprecision_init(c, keyLength); + multiprecision_init(c, 2 * keyLength); //assume little endian right now for (uint32_t i = 0; i < keyLength; i++) { @@ -340,7 +340,7 @@ void multiprecision_fast_mod(DWORD *c, DWORD *a) c[2] += V; V = c[2] < V; c[2] += U; - V = c[2] < U; + V += c[2] < U; c[3] += V; V = c[3] < V; c[4] += V; @@ -594,6 +594,7 @@ void multiprecision_fast_mod_P256(DWORD *c, DWORD *a) void multiprecision_inv_mod(DWORD *aminus, DWORD *u, uint32_t keyLength) { + DWORD u_local[KEY_LENGTH_DWORDS_P256]; DWORD v[KEY_LENGTH_DWORDS_P256]; DWORD A[KEY_LENGTH_DWORDS_P256 + 1]; DWORD C[KEY_LENGTH_DWORDS_P256 + 1]; @@ -605,14 +606,15 @@ void multiprecision_inv_mod(DWORD *aminus, DWORD *u, uint32_t keyLength) modp = curve.p; } + multiprecision_copy(u_local, u, keyLength); multiprecision_copy(v, modp, keyLength); multiprecision_init(A, keyLength); multiprecision_init(C, keyLength); A[0] = 1; - while (!multiprecision_iszero(u, keyLength)) { - while (!(u[0] & 0x01)) { // u is even - multiprecision_rshift(u, u, keyLength); + while (!multiprecision_iszero(u_local, keyLength)) { + while (!(u_local[0] & 0x01)) { // u is even + multiprecision_rshift(u_local, u_local, keyLength); if (!(A[0] & 0x01)) { // A is even multiprecision_rshift(A, A, keyLength); } else { @@ -633,11 +635,11 @@ void multiprecision_inv_mod(DWORD *aminus, DWORD *u, uint32_t keyLength) } } - if (multiprecision_compare(u, v, keyLength) >= 0) { - multiprecision_sub(u, u, v, keyLength); + if (multiprecision_compare(u_local, v, keyLength) >= 0) { + multiprecision_sub(u_local, u_local, v, keyLength); multiprecision_sub_mod(A, A, C, keyLength); } else { - multiprecision_sub(v, v, u, keyLength); + multiprecision_sub(v, v, u_local, keyLength); multiprecision_sub_mod(C, C, A, keyLength); } } diff --git a/components/bt/host/bluedroid/stack/smp/smp_act.c b/components/bt/host/bluedroid/stack/smp/smp_act.c index 1c88b8dcd34..ba20aaeda30 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_act.c +++ b/components/bt/host/bluedroid/stack/smp/smp_act.c @@ -406,7 +406,7 @@ void smp_send_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) smp_send_cmd(SMP_OPCODE_ID_ADDR, p_cb); #if (BLE_INCLUDED == TRUE) - tBTM_LE_KEY_VALUE le_key; + tBTM_LE_KEY_VALUE le_key = {0}; if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND)) { btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_LID, &le_key, TRUE); @@ -1440,7 +1440,9 @@ void smp_key_distribution(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) if (smp_get_state() == SMP_STATE_BOND_PENDING) { if (p_cb->derive_lk) { tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_cb->pairing_bda); - if (!(p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_AUTHED) && + if (p_dev_rec == NULL) { + SMP_TRACE_WARNING("%s device record not found, skip LK derivation", __func__); + } else if (!(p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_AUTHED) && (p_dev_rec->sec_flags & BTM_SEC_LINK_KEY_AUTHED)) { SMP_TRACE_DEBUG("%s BREDR key is higher security than existing LE keys, " "don't derive LK from LTK", __func__); @@ -1698,7 +1700,11 @@ void smp_both_have_public_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) SMP_TRACE_DEBUG("%s\n", __func__); /* invokes DHKey computation */ - smp_compute_dhkey(p_cb); + if (!smp_compute_dhkey(p_cb)) { + UINT8 reason = SMP_PAIR_INTERNAL_ERR; + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason); + return; + } /* on slave side invokes sending local public key to the peer */ if (p_cb->role == HCI_ROLE_SLAVE) { diff --git a/components/bt/host/bluedroid/stack/smp/smp_api.c b/components/bt/host/bluedroid/stack/smp/smp_api.c index 0b00bf151c0..7a592b775d6 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_api.c +++ b/components/bt/host/bluedroid/stack/smp/smp_api.c @@ -483,6 +483,10 @@ void SMP_SecureConnectionOobDataReply(UINT8 *p_data) return; } + if (p_cb->state != SMP_STATE_WAIT_APP_RSP || p_cb->cb_evt != SMP_SC_OOB_REQ_EVT) { + return; + } + /* Set local oob data when req_oob_type = SMP_OOB_BOTH */ memcpy(&p_oob->loc_oob_data, smp_get_local_oob_data(), sizeof(tSMP_LOC_OOB_DATA)); @@ -491,10 +495,6 @@ void SMP_SecureConnectionOobDataReply(UINT8 *p_data) __FUNCTION__, p_cb->req_oob_type, p_oob->loc_oob_data.present, p_oob->peer_oob_data.present); - if (p_cb->state != SMP_STATE_WAIT_APP_RSP || p_cb->cb_evt != SMP_SC_OOB_REQ_EVT) { - return; - } - BOOLEAN data_missing = FALSE; switch (p_cb->req_oob_type) { case SMP_OOB_PEER: diff --git a/components/bt/host/bluedroid/stack/smp/smp_cmac.c b/components/bt/host/bluedroid/stack/smp/smp_cmac.c index b097a05d235..e58e28ebcbd 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_cmac.c +++ b/components/bt/host/bluedroid/stack/smp/smp_cmac.c @@ -154,6 +154,11 @@ static BOOLEAN cmac_aes_k_calculate(BT_OCTET16 key, UINT8 *p_signature, UINT16 t SMP_TRACE_EVENT ("cmac_aes_k_calculate "); + if (cmac_cb.round == 0) { + SMP_TRACE_ERROR("%s round is 0", __func__); + return FALSE; + } + while (i <= cmac_cb.round) { smp_xor_128(&cmac_cb.text[(cmac_cb.round - i)*BT_OCTET16_LEN], x); /* Mi' := Mi (+) X */ @@ -305,6 +310,11 @@ BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length, SMP_TRACE_EVENT ("%s", __func__); + if (tlen == 0 || tlen > BT_OCTET16_LEN) { + SMP_TRACE_ERROR("%s invalid tlen=%d", __func__, tlen); + return FALSE; + } + #if (SMP_CRYPTO_MBEDTLS == TRUE) { /* diff --git a/components/bt/host/bluedroid/stack/smp/smp_keys.c b/components/bt/host/bluedroid/stack/smp/smp_keys.c index f96751c72a6..ced75102f33 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_keys.c +++ b/components/bt/host/bluedroid/stack/smp/smp_keys.c @@ -629,10 +629,10 @@ void smp_concatenate_peer( tSMP_CB *p_cb, UINT8 **p_data, UINT8 op_code) ** Description Generate Confirm/Compare Step1: ** p1 = press || preq || rat' || iat' ** -** Returns void +** Returns BOOLEAN ** *******************************************************************************/ -void smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) +BOOLEAN smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) { UINT8 *p = (UINT8 *)p1; tBLE_ADDR_TYPE addr_type = 0; @@ -642,7 +642,7 @@ void smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) if (!BTM_ReadRemoteConnectionAddr(p_cb->pairing_bda, remote_bda, &addr_type)) { SMP_TRACE_ERROR("can not generate confirm for unknown device\n"); - return; + return FALSE; } BTM_ReadConnectionAddr( p_cb->pairing_bda, p_cb->local_bda, &p_cb->addr_type); @@ -670,6 +670,7 @@ void smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) SMP_TRACE_DEBUG("p1 = press || preq || rat' || iat'\n"); smp_debug_print_nbyte_little_endian ((UINT8 *)p1, (const UINT8 *)"P1", 16); #endif + return TRUE; } /******************************************************************************* @@ -679,10 +680,10 @@ void smp_gen_p1_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p1) ** Description Generate Confirm/Compare Step2: ** p2 = padding || ia || ra ** -** Returns void +** Returns FALSE if remote address unavailable, TRUE otherwise ** *******************************************************************************/ -void smp_gen_p2_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p2) +BOOLEAN smp_gen_p2_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p2) { UINT8 *p = (UINT8 *)p2; BD_ADDR remote_bda; @@ -690,7 +691,7 @@ void smp_gen_p2_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p2) SMP_TRACE_DEBUG ("smp_gen_p2_4_confirm\n"); if (!BTM_ReadRemoteConnectionAddr(p_cb->pairing_bda, remote_bda, &addr_type)) { SMP_TRACE_ERROR("can not generate confirm p2 for unknown device\n"); - return; + return FALSE; } SMP_TRACE_DEBUG ("smp_gen_p2_4_confirm\n"); @@ -712,6 +713,7 @@ void smp_gen_p2_4_confirm( tSMP_CB *p_cb, BT_OCTET16 p2) SMP_TRACE_DEBUG("p2 = padding || ia || ra"); smp_debug_print_nbyte_little_endian(p2, (const UINT8 *)"p2", 16); #endif + return TRUE; } /******************************************************************************* @@ -733,7 +735,11 @@ void smp_calculate_comfirm (tSMP_CB *p_cb, BT_OCTET16 rand, BD_ADDR bda) SMP_TRACE_DEBUG ("smp_calculate_comfirm \n"); /* generate p1 = press || preq || rat' || iat' */ - smp_gen_p1_4_confirm(p_cb, p1); + if (!smp_gen_p1_4_confirm(p_cb, p1)) { + + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); + return ; + } /* p1 = rand XOR p1 */ smp_xor_128(p1, rand); @@ -771,7 +777,10 @@ static void smp_calculate_comfirm_cont(tSMP_CB *p_cb, tSMP_ENC *p) smp_debug_print_nbyte_little_endian (p->param_buf, (const UINT8 *)"C1", 16); #endif - smp_gen_p2_4_confirm(p_cb, p2); + if (!smp_gen_p2_4_confirm(p_cb, p2)) { + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status); + return; + } /* calculate p2 = (p1' XOR p2) */ smp_xor_128(p2, p->param_buf); @@ -1146,6 +1155,12 @@ void smp_continue_private_key_creation (tSMP_CB *p_cb, tBTM_RAND_ENC *p) UINT8 state = p_cb->rand_enc_proc_state & ~0x80; SMP_TRACE_DEBUG ("%s state=0x%x\n", __func__, state); + /* Validate param_len to prevent buffer overflow/underflow */ + if (p == NULL || p->param_len != BT_OCTET8_LEN) { + SMP_TRACE_ERROR("invalid param_len: %d, expected %d\n", p ? p->param_len : 0, BT_OCTET8_LEN); + return; + } + switch (state) { case SMP_GENERATE_PRIVATE_KEY_0_7: memcpy((void *)p_cb->private_key, p->param_buf, p->param_len); @@ -1258,6 +1273,7 @@ void smp_process_private_key(tSMP_CB *p_cb) p_cb->loc_publ_key.x[i] = pub_be[1 + BT_OCTET32_LEN - 1 - i]; p_cb->loc_publ_key.y[i] = pub_be[33 + BT_OCTET32_LEN - 1 - i]; } + psa_ok = TRUE; mbedtls_pubkey_cleanup: /* Clear sensitive data - mbedtls_ecp_keypair_free will zero the private key */ @@ -1323,10 +1339,10 @@ mbedtls_pubkey_cleanup: ** key and peer public key; ** - saves the new public key x-coordinate as DHKey. ** -** Returns void +** Returns TRUE if DHKey was computed successfully, FALSE otherwise. ** *******************************************************************************/ -void smp_compute_dhkey (tSMP_CB *p_cb) +BOOLEAN smp_compute_dhkey (tSMP_CB *p_cb) { SMP_TRACE_DEBUG ("%s\n", __FUNCTION__); @@ -1398,6 +1414,7 @@ void smp_compute_dhkey (tSMP_CB *p_cb) for (int i = 0; i < BT_OCTET32_LEN; i++) { p_cb->dhkey[i] = shared_secret[BT_OCTET32_LEN - 1 - i]; } + psa_ok = TRUE; mbedtls_dhkey_cleanup: /* Clear sensitive data - mbedtls_mpi_free will zero the memory */ @@ -1428,11 +1445,11 @@ mbedtls_dhkey_cleanup: /* Validate peer public key */ /* uECC_valid_public_key returns 0 if valid, negative value if invalid */ - if (uECC_valid_public_key(peer_pub_be, uECC_secp256r1()) < 0) { + if (uECC_valid_public_key(peer_pub_be, uECC_secp256r1()) != 0) { SMP_TRACE_ERROR("%s Invalid peer public key\n", __FUNCTION__); memset(priv_be, 0, sizeof(priv_be)); memset(peer_pub_be, 0, sizeof(peer_pub_be)); - return; + return FALSE; } /* Compute ECDH shared secret */ @@ -1442,7 +1459,7 @@ mbedtls_dhkey_cleanup: memset(priv_be, 0, sizeof(priv_be)); memset(peer_pub_be, 0, sizeof(peer_pub_be)); memset(shared_secret, 0, sizeof(shared_secret)); - return; + return FALSE; } /* Convert shared secret from big-endian to little-endian for DHKey */ @@ -1463,9 +1480,16 @@ mbedtls_dhkey_cleanup: memcpy(peer_publ_key.x, p_cb->peer_publ_key.x, BT_OCTET32_LEN); memcpy(peer_publ_key.y, p_cb->peer_publ_key.y, BT_OCTET32_LEN); + if (!ECC_CheckPointIsInElliCur_P256(&peer_publ_key)) { + SMP_TRACE_ERROR("%s Invalid peer public key\n", __FUNCTION__); + memset(private_key, 0, sizeof(private_key)); + return FALSE; + } + ECC_PointMult(&new_publ_key, &peer_publ_key, (DWORD *) private_key, KEY_LENGTH_DWORDS_P256); memcpy(p_cb->dhkey, new_publ_key.x, BT_OCTET32_LEN); + memset(private_key, 0, sizeof(private_key)); #endif /* SMP_CRYPTO_MBEDTLS */ smp_debug_print_nbyte_little_endian (p_cb->dhkey, (const UINT8 *)"DHKey", @@ -1477,6 +1501,7 @@ mbedtls_dhkey_cleanup: BT_OCTET32_LEN); smp_debug_print_nbyte_little_endian (p_cb->peer_publ_key.y, (const UINT8 *)"rem public(y)", BT_OCTET32_LEN); + return TRUE; } /******************************************************************************* @@ -1587,6 +1612,9 @@ void smp_calculate_peer_commitment(tSMP_CB *p_cb, BT_OCTET16 output_buf) ** ** Note The LSB is the first octet, the MSB is the last octet of ** the AES-CMAC input/output stream. +** In little-endian implementation, the message is constructed +** as Z||V||U (reversed parameter order) to compensate for +** byte order differences with the big-endian specification. ** *******************************************************************************/ void smp_calculate_f4(UINT8 *u, UINT8 *v, UINT8 *x, UINT8 z, UINT8 *c) @@ -2085,11 +2113,16 @@ BOOLEAN smp_calculate_f5_key(UINT8 *w, UINT8 *t) *******************************************************************************/ void smp_calculate_local_dhkey_check(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { - UINT8 iocap[3], a[7], b[7]; + UINT8 iocap[3], a[7] = {0}, b[7] = {0}; SMP_TRACE_DEBUG ("%s", __FUNCTION__); - smp_calculate_f5_mackey_and_long_term_key(p_cb); + if (!smp_calculate_f5_mackey_and_long_term_key(p_cb)) { + UINT8 reason = SMP_PAIR_FAIL_UNKNOWN; + p_cb->failure = reason; + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason); + return; + } smp_collect_local_io_capabilities(iocap, p_cb); @@ -2112,7 +2145,7 @@ void smp_calculate_local_dhkey_check(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) *******************************************************************************/ void smp_calculate_peer_dhkey_check(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) { - UINT8 iocap[3], a[7], b[7]; + UINT8 iocap[3], a[7] = {0}, b[7] = {0}; BT_OCTET16 param_buf; BOOLEAN ret; tSMP_KEY key; @@ -2526,37 +2559,62 @@ static void smp_rand_back(tBTM_RAND_ENC *p) UINT8 *pp = NULL; UINT8 failure = SMP_PAIR_FAIL_UNKNOWN; UINT8 state = p_cb->rand_enc_proc_state & ~0x80; + BOOLEAN check_failed = FALSE; SMP_TRACE_DEBUG ("%s state=0x%x", __FUNCTION__, state); if (p && p->status == HCI_SUCCESS) { switch (state) { case SMP_GEN_SRAND_MRAND: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } memcpy((void *)p_cb->rand, p->param_buf, p->param_len); smp_generate_rand_cont(p_cb, NULL); break; case SMP_GEN_SRAND_MRAND_CONT: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } memcpy((void *)&p_cb->rand[8], p->param_buf, p->param_len); smp_generate_confirm(p_cb, NULL); break; case SMP_GEN_DIV_LTK: + if (p->param_len < 2) { + check_failed = TRUE; + break; + } pp = p->param_buf; STREAM_TO_UINT16(p_cb->div, pp); smp_generate_ltk_cont(p_cb, NULL); break; case SMP_GEN_DIV_CSRK: + if (p->param_len < 2) { + check_failed = TRUE; + break; + } pp = p->param_buf; STREAM_TO_UINT16(p_cb->div, pp); smp_compute_csrk(p_cb, NULL); break; case SMP_GEN_TK: + if (p->param_len < 4) { + check_failed = TRUE; + break; + } smp_proc_passkey(p_cb, p); break; case SMP_GEN_RAND_V: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } memcpy(p_cb->enc_rand, p->param_buf, BT_OCTET8_LEN); smp_generate_y(p_cb, NULL); break; @@ -2565,21 +2623,34 @@ static void smp_rand_back(tBTM_RAND_ENC *p) case SMP_GENERATE_PRIVATE_KEY_8_15: case SMP_GENERATE_PRIVATE_KEY_16_23: case SMP_GENERATE_PRIVATE_KEY_24_31: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } smp_continue_private_key_creation(p_cb, p); break; case SMP_GEN_NONCE_0_7: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } memcpy((void *)p_cb->rand, p->param_buf, p->param_len); smp_finish_nonce_generation(p_cb); break; case SMP_GEN_NONCE_8_15: + if (p->param_len != BT_OCTET8_LEN) { + check_failed = TRUE; + break; + } memcpy((void *)&p_cb->rand[8], p->param_buf, p->param_len); smp_process_new_nonce(p_cb); break; } - - return; + if (!check_failed) { + return; + } } SMP_TRACE_ERROR("%s key generation failed: (%d)", __FUNCTION__, p_cb->rand_enc_proc_state); diff --git a/components/bt/host/bluedroid/stack/smp/smp_l2c.c b/components/bt/host/bluedroid/stack/smp/smp_l2c.c index c109b9d002c..9b019ae73fa 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_l2c.c +++ b/components/bt/host/bluedroid/stack/smp/smp_l2c.c @@ -118,8 +118,8 @@ static void smp_connect_callback (UINT16 channel, BD_ADDR bd_addr, BOOLEAN conne if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) == 0) { SMP_TRACE_EVENT ("%s() for pairing BDA: %08x%04x Event: %s\n", __FUNCTION__, - (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3], - (bd_addr[4] << 8) + bd_addr[5], + ((UINT32)bd_addr[0] << 24) + ((UINT32)bd_addr[1] << 16) + ((UINT32)bd_addr[2] << 8) + bd_addr[3], + ((UINT32)bd_addr[4] << 8) + bd_addr[5], (connected) ? "connected" : "disconnected"); if (connected) { @@ -283,8 +283,8 @@ static void smp_br_connect_callback(UINT16 channel, BD_ADDR bd_addr, BOOLEAN con SMP_TRACE_EVENT ("%s for pairing BDA: %08x%04x Event: %s\n", __func__, - (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3], - (bd_addr[4] << 8) + bd_addr[5], + ((UINT32)bd_addr[0] << 24) + ((UINT32)bd_addr[1] << 16) + ((UINT32)bd_addr[2] << 8) + bd_addr[3], + ((UINT32)bd_addr[4] << 8) + bd_addr[5], (connected) ? "connected" : "disconnected"); if (connected) { diff --git a/components/bt/host/bluedroid/stack/smp/smp_main.c b/components/bt/host/bluedroid/stack/smp/smp_main.c index fa4d5ffbe32..fd9bc0c6d7e 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_main.c +++ b/components/bt/host/bluedroid/stack/smp/smp_main.c @@ -746,7 +746,7 @@ void smp_sm_event(tSMP_CB *p_cb, tSMP_EVENT event, void *p_data) /* lookup entry /w event & curr_state */ /* If entry is ignore, return. * Otherwise, get state table (according to curr_state or all_state) */ - if ((event <= SMP_MAX_EVT) && ( (entry = entry_table[event - 1][curr_state]) != SMP_SM_IGNORE )) { + if ((event >= 1 && event <= SMP_MAX_EVT) && ( (entry = entry_table[event - 1][curr_state]) != SMP_SM_IGNORE )) { if (entry & SMP_ALL_TBL_MASK) { entry &= ~SMP_ALL_TBL_MASK; state_table = smp_all_table; @@ -803,7 +803,7 @@ const char *smp_get_event_name(tSMP_EVENT event) { const char *p_str = smp_event_name[SMP_MAX_EVT]; - if (event <= SMP_MAX_EVT) { + if (event >= 1 && event <= SMP_MAX_EVT) { p_str = smp_event_name[event - 1]; } return p_str; diff --git a/components/bt/host/bluedroid/stack/smp/smp_utils.c b/components/bt/host/bluedroid/stack/smp/smp_utils.c index f4d0987029f..0276f8b7e2b 100644 --- a/components/bt/host/bluedroid/stack/smp/smp_utils.c +++ b/components/bt/host/bluedroid/stack/smp/smp_utils.c @@ -351,7 +351,7 @@ BOOLEAN smp_send_cmd(UINT8 cmd_code, tSMP_CB *p_cb) BOOLEAN sent = FALSE; UINT8 failure = SMP_PAIR_INTERNAL_ERR; SMP_TRACE_EVENT("smp_send_cmd on l2cap cmd_code=0x%x\n", cmd_code); - if ( cmd_code <= (SMP_OPCODE_MAX + 1 /* for SMP_OPCODE_PAIR_COMMITM */) && + if ( cmd_code < SMP_OPCODE_ARRAY_SIZE && smp_cmd_build_act[cmd_code] != NULL) { p_buf = (*smp_cmd_build_act[cmd_code])(cmd_code, p_cb); @@ -749,11 +749,14 @@ static BT_HDR *smp_build_pairing_commitment_cmd(UINT8 cmd_code, tSMP_CB *p_cb) UINT8 *p; UNUSED(cmd_code); - SMP_TRACE_EVENT("%s\n", __func__); if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR) + SMP_PAIR_COMMITM_SIZE + L2CAP_MIN_OFFSET)) != NULL) { p = (UINT8 *)(p_buf + 1) + L2CAP_MIN_OFFSET; - + /* The transmitter sends 0x03 universally. + The receiver performs automatic conversion according to its capabilities to ensure backward compatibility. + The state machine operates using the translated opcode. please refer to smp_data_received() in smp_l2c.c + Please note that using SMP OPCODE to CONFIRM is not an error. + */ UINT8_TO_STREAM (p, SMP_OPCODE_CONFIRM); ARRAY_TO_STREAM (p, p_cb->commitment, BT_OCTET16_LEN); @@ -858,6 +861,11 @@ void smp_convert_string_to_tk(BT_OCTET16 tk, UINT32 passkey) void smp_mask_enc_key(UINT8 loc_enc_size, UINT8 *p_data) { SMP_TRACE_EVENT("smp_mask_enc_key\n"); + if (loc_enc_size < SMP_ENCR_KEY_SIZE_MIN) { + SMP_TRACE_ERROR("smp_mask_enc_key: loc_enc_size %d below minimum %d\n", + loc_enc_size, SMP_ENCR_KEY_SIZE_MIN); + return; + } if (loc_enc_size < BT_OCTET16_LEN) { for (; loc_enc_size < BT_OCTET16_LEN; loc_enc_size ++) { * (p_data + loc_enc_size) = 0; @@ -1057,7 +1065,7 @@ BOOLEAN smp_command_has_invalid_parameters(tSMP_CB *p_cb) SMP_TRACE_DEBUG("%s for cmd code 0x%02x\n", __func__, cmd_code); - if ((cmd_code > (SMP_OPCODE_MAX + 1 /* for SMP_OPCODE_PAIR_COMMITM */)) || + if ((cmd_code >= SMP_OPCODE_ARRAY_SIZE) || (cmd_code < SMP_OPCODE_MIN)) { SMP_TRACE_WARNING("Somehow received command with the RESERVED code 0x%02x\n", cmd_code); return TRUE; @@ -1462,7 +1470,7 @@ void smp_collect_peer_io_capabilities(UINT8 *iocap, tSMP_CB *p_cb) void smp_collect_local_ble_address(UINT8 *le_addr, tSMP_CB *p_cb) { tBLE_ADDR_TYPE addr_type = 0; - BD_ADDR bda; + BD_ADDR bda = {0}; UINT8 *p = le_addr; SMP_TRACE_DEBUG("%s\n", __func__); @@ -1485,7 +1493,7 @@ void smp_collect_local_ble_address(UINT8 *le_addr, tSMP_CB *p_cb) void smp_collect_peer_ble_address(UINT8 *le_addr, tSMP_CB *p_cb) { tBLE_ADDR_TYPE addr_type = 0; - BD_ADDR bda; + BD_ADDR bda = {0}; UINT8 *p = le_addr; SMP_TRACE_DEBUG("%s\n", __func__); @@ -1574,8 +1582,8 @@ void smp_save_secure_connections_long_term_key(tSMP_CB *p_cb) *******************************************************************************/ BOOLEAN smp_calculate_f5_mackey_and_long_term_key(tSMP_CB *p_cb) { - UINT8 a[7]; - UINT8 b[7]; + UINT8 a[7] = {0}; + UINT8 b[7] = {0}; UINT8 *p_na; UINT8 *p_nb; diff --git a/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_central/main/main.c b/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_central/main/main.c index cebe3804e4e..2eb6989bb99 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_central/main/main.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_central/main/main.c @@ -208,7 +208,11 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param creat_conn_params.phy_1m_conn_params = &phy_1m_conn_params; creat_conn_params.phy_2m_conn_params = &phy_2m_conn_params; creat_conn_params.phy_coded_conn_params = &phy_coded_conn_params; - esp_ble_gattc_enh_open(gl_profile_tab[PROFILE_A_APP_ID].gattc_if, &creat_conn_params); + if (esp_ble_gattc_enh_open(gl_profile_tab[PROFILE_A_APP_ID].gattc_if, &creat_conn_params) != ESP_OK) + { + connect = false; + ESP_LOGE(TAG, "Failed to open connection"); + } } } break; diff --git a/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_peripheral/main/main.c b/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_peripheral/main/main.c index d64e6ff2597..355d6a55096 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_peripheral/main/main.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_conn_subrating_peripheral/main/main.c @@ -51,8 +51,6 @@ } \ } while(0); -static uint16_t conn_handle = 0xFFFF; - uint16_t subrating_handle_table[SUBRATING_IDX_NB]; /* UUIDs */ @@ -249,7 +247,6 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_ ESP_LOGI(TAG, "Connected, conn_id %u, remote "ESP_BD_ADDR_STR"", param->connect.conn_id, ESP_BD_ADDR_HEX(param->connect.remote_bda)); gl_profile_tab[PROFILE_A_APP_ID].conn_id = param->connect.conn_id; - conn_handle = param->connect.conn_id; esp_ble_conn_update_params_t conn_params = {0}; memcpy(conn_params.bda, param->connect.remote_bda, sizeof(esp_bd_addr_t)); @@ -267,7 +264,6 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_ case ESP_GATTS_DISCONNECT_EVT: ESP_LOGI(TAG, "Disconnected, remote "ESP_BD_ADDR_STR", reason 0x%02x", ESP_BD_ADDR_HEX(param->disconnect.remote_bda), param->disconnect.reason); - conn_handle = 0xFFFF; // Restart extended advertising esp_ble_gap_ext_adv_start(NUM_EXT_ADV, ext_adv); break; diff --git a/examples/bluetooth/bluedroid/ble_50/ble_connection_central_with_cte/main/connection_central_with_cte.c b/examples/bluetooth/bluedroid/ble_50/ble_connection_central_with_cte/main/connection_central_with_cte.c index 985e517e430..a3346407f04 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_connection_central_with_cte/main/connection_central_with_cte.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_connection_central_with_cte/main/connection_central_with_cte.c @@ -316,6 +316,7 @@ static void gattc_profile_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_ ESP_BD_ADDR_HEX(p_data->disconnect.remote_bda), p_data->disconnect.reason); connect = false; get_service = false; + esp_ble_gap_start_ext_scan(EXT_SCAN_DURATION, EXT_SCAN_PERIOD); break; default: break; @@ -476,7 +477,7 @@ static void cte_event_handler(esp_ble_cte_cb_event_t event, esp_ble_cte_cb_param param->conn_iq_rpt.pkt_status, param->conn_iq_rpt.conn_evt_counter, param->conn_iq_rpt.sample_count); ESP_LOG_BUFFER_HEX("i_sample", ¶m->conn_iq_rpt.i_sample[0], param->conn_iq_rpt.sample_count); - ESP_LOG_BUFFER_HEX("q_sample", ¶m->conn_iq_rpt.i_sample[0], param->conn_iq_rpt.sample_count); + ESP_LOG_BUFFER_HEX("q_sample", ¶m->conn_iq_rpt.q_sample[0], param->conn_iq_rpt.sample_count); break; case ESP_BLE_CTE_REQUEST_FAILED_EVT: ESP_LOGI(LOG_TAG, "CTE connection request failed, conn_handle %d reason 0x%x", param->req_failed_evt.conn_handle, param->req_failed_evt.reason); diff --git a/examples/bluetooth/bluedroid/ble_50/ble_pawr_advertiser_conn/main/main.c b/examples/bluetooth/bluedroid/ble_50/ble_pawr_advertiser_conn/main/main.c index d6ba4790114..23e7e7b4656 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_pawr_advertiser_conn/main/main.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_pawr_advertiser_conn/main/main.c @@ -371,6 +371,7 @@ static void gattc_profile_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_ } case ESP_GATTC_OPEN_EVT: if (p_data->open.status != ESP_GATT_OK) { + is_connected = false; ESP_LOGE(TAG, "GATTC open failed, status %d", p_data->open.status); break; } diff --git a/examples/bluetooth/bluedroid/ble_50/ble_pawr_synchronizer/main/ble_pawr_synchronizer_demo.c b/examples/bluetooth/bluedroid/ble_50/ble_pawr_synchronizer/main/ble_pawr_synchronizer_demo.c index 91e3ef2dcbd..e6d1b44e37d 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_pawr_synchronizer/main/ble_pawr_synchronizer_demo.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_pawr_synchronizer/main/ble_pawr_synchronizer_demo.c @@ -182,18 +182,28 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param break; case ESP_GAP_BLE_PERIODIC_ADV_CREATE_SYNC_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising create sync, status %d", param->period_adv_create_sync.status); + if (param->period_adv_create_sync.status != ESP_BT_STATUS_SUCCESS) { + periodic_sync = false; + } break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_CANCEL_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync cancel, status %d", param->period_adv_sync_cancel.status); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_TERMINATE_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync terminate, status %d", param->period_adv_sync_term.status); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_LOST_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync lost, sync handle %d", param->periodic_adv_sync_lost.sync_handle); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_ESTAB_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync establish, status %d", param->periodic_adv_sync_estab.status); + if (param->periodic_adv_sync_estab.status != ESP_BT_STATUS_SUCCESS) { + periodic_sync = false; + break; + } ESP_LOGI(LOG_TAG, "address "ESP_BD_ADDR_STR"", ESP_BD_ADDR_HEX(param->periodic_adv_sync_estab.adv_addr)); ESP_LOGI(LOG_TAG, "sync handle %d sid %d perioic adv interval %d adv phy %d", param->periodic_adv_sync_estab.sync_handle, param->periodic_adv_sync_estab.sid, diff --git a/examples/bluetooth/bluedroid/ble_50/ble_periodic_adv_with_cte/main/periodic_adv_with_cte_demo.c b/examples/bluetooth/bluedroid/ble_50/ble_periodic_adv_with_cte/main/periodic_adv_with_cte_demo.c index 52f52215308..af7019f728b 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_periodic_adv_with_cte/main/periodic_adv_with_cte_demo.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_periodic_adv_with_cte/main/periodic_adv_with_cte_demo.c @@ -224,7 +224,11 @@ void app_main(void) return; } - esp_ble_cte_register_callback(cte_event_handler); + ret = esp_ble_cte_register_callback(cte_event_handler); + if (ret != ESP_OK) { + ESP_LOGE(LOG_TAG, "CTE register error, error code = %x", ret); + return; + } vTaskDelay(200 / portTICK_PERIOD_MS); diff --git a/examples/bluetooth/bluedroid/ble_50/ble_periodic_sync_with_cte/main/periodic_sync_with_cte_demo.c b/examples/bluetooth/bluedroid/ble_50/ble_periodic_sync_with_cte/main/periodic_sync_with_cte_demo.c index 78252ad22e0..d1cea760bdf 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_periodic_sync_with_cte/main/periodic_sync_with_cte_demo.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_periodic_sync_with_cte/main/periodic_sync_with_cte_demo.c @@ -99,18 +99,28 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param break; case ESP_GAP_BLE_PERIODIC_ADV_CREATE_SYNC_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising create sync, status %d", param->period_adv_create_sync.status); + if (param->period_adv_create_sync.status != ESP_BT_STATUS_SUCCESS) { + periodic_sync = false; + } break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_CANCEL_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync cancel, status %d", param->period_adv_sync_cancel.status); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_TERMINATE_COMPLETE_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync terminate, status %d", param->period_adv_sync_term.status); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_LOST_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync lost, sync handle %d", param->periodic_adv_sync_lost.sync_handle); + periodic_sync = false; break; case ESP_GAP_BLE_PERIODIC_ADV_SYNC_ESTAB_EVT: ESP_LOGI(LOG_TAG, "Periodic advertising sync establish, status %d", param->periodic_adv_sync_estab.status); + if (param->periodic_adv_sync_estab.status != ESP_BT_STATUS_SUCCESS) { + periodic_sync = false; + break; + } ESP_LOGI(LOG_TAG, "address "ESP_BD_ADDR_STR"", ESP_BD_ADDR_HEX(param->periodic_adv_sync_estab.adv_addr)); ESP_LOGI(LOG_TAG, "sync handle %d sid %d perioic adv interval %d adv phy %d", param->periodic_adv_sync_estab.sync_handle, param->periodic_adv_sync_estab.sid, @@ -136,7 +146,9 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param periodic_adv_sync_params.sid = param->ext_adv_report.params.sid; periodic_adv_sync_params.addr_type = param->ext_adv_report.params.addr_type; memcpy(periodic_adv_sync_params.addr, param->ext_adv_report.params.addr, sizeof(esp_bd_addr_t)); - esp_ble_gap_periodic_adv_create_sync(&periodic_adv_sync_params); + if (esp_ble_gap_periodic_adv_create_sync(&periodic_adv_sync_params) != ESP_OK) { + periodic_sync = false; + } } } break; diff --git a/examples/bluetooth/bluedroid/ble_50/ble_power_control_central/main/main.c b/examples/bluetooth/bluedroid/ble_50/ble_power_control_central/main/main.c index 1d7da9af717..383dc270db1 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_power_control_central/main/main.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_power_control_central/main/main.c @@ -249,7 +249,11 @@ static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param creat_conn_params.phy_1m_conn_params = &phy_1m_conn_params; creat_conn_params.phy_2m_conn_params = &phy_2m_conn_params; creat_conn_params.phy_coded_conn_params = &phy_coded_conn_params; - esp_ble_gattc_enh_open(gl_profile_tab[PROFILE_A_APP_ID].gattc_if, &creat_conn_params); + if (esp_ble_gattc_enh_open(gl_profile_tab[PROFILE_A_APP_ID].gattc_if, &creat_conn_params) != ESP_OK) { + ESP_LOGE(TAG, "open failed, restart scan"); + connect = false; + esp_ble_gap_start_ext_scan(0, 0); + } } } } diff --git a/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/main.c b/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/main.c index df5fb01772c..16b493d195d 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/main.c +++ b/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/main.c @@ -63,7 +63,7 @@ static const uint16_t character_declaration_uuid = ESP_GATT_UUID_CHAR_DECLARE; /* Service UUID - must be a variable, not a macro, to take address */ static const uint16_t power_control_service_uuid = BLE_UUID_POWER_CONTROL_SERVICE_VAL; -static const uint16_t power_level_char_uuid = BLE_UUID_POWER_CONTROL_SERVICE_VAL; +static const uint16_t power_level_char_uuid = BLE_UUID_POWER_LEVEL_CHAR_UUID; /* Characteristic properties */ static const uint8_t char_prop_read = ESP_GATT_CHAR_PROP_BIT_READ; @@ -280,7 +280,7 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_ ESP_LOGI(TAG, "Connected, conn_id %u, remote "ESP_BD_ADDR_STR"", param->connect.conn_id, ESP_BD_ADDR_HEX(param->connect.remote_bda)); gl_profile_tab[PROFILE_A_APP_ID].conn_id = param->connect.conn_id; - conn_handle = param->connect.conn_id; + conn_handle = param->connect.conn_handle; esp_ble_conn_update_params_t conn_params = {0}; memcpy(conn_params.bda, param->connect.remote_bda, sizeof(esp_bd_addr_t)); @@ -302,7 +302,10 @@ static void gatts_profile_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_ ESP_BD_ADDR_HEX(param->disconnect.remote_bda), param->disconnect.reason); conn_handle = 0xFFFF; // Restart extended advertising - FUNC_SEND_WAIT_SEM(esp_ble_gap_ext_adv_start(NUM_EXT_ADV, ext_adv), test_sem); + esp_err_t ret = esp_ble_gap_ext_adv_start(NUM_EXT_ADV, ext_adv); + if (ret != ESP_OK) { + ESP_LOGE(TAG, "Failed to restart advertising, error = %d", ret); + } break; case ESP_GATTS_READ_EVT: ESP_LOGI(TAG, "Read event, handle %d", param->read.handle); @@ -408,11 +411,6 @@ void app_main(void) // Create semaphore for extended advertising test_sem = xSemaphoreCreateBinary(); - // Start extended advertising - esp_bd_addr_t addr; - esp_ble_gap_addr_create_static(addr); - ESP_LOGI(TAG, "Device Address: "ESP_BD_ADDR_STR"", ESP_BD_ADDR_HEX(addr)); - // Set extended advertising parameters FUNC_SEND_WAIT_SEM(esp_ble_gap_ext_adv_set_params(EXT_ADV_HANDLE, &ext_adv_params), test_sem); diff --git a/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/power_control_service.h b/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/power_control_service.h index 5a3ac10ed9e..1a85d014b79 100644 --- a/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/power_control_service.h +++ b/examples/bluetooth/bluedroid/ble_50/ble_power_control_peripheral/main/power_control_service.h @@ -11,6 +11,8 @@ /* Power Control Service UUIDs */ #define BLE_UUID_POWER_CONTROL_SERVICE_VAL 0xFF01 +#define BLE_UUID_POWER_LEVEL_CHAR_UUID 0xFF02 + /* Attributes State Machine */ enum { IDX_POWER_CONTROL_SVC,