Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-11 17:52:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): fix GAP BLE API parameter validation

Browse Source 
(cherry picked from commit e3311c81c4)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
This commit is contained in:
Zhi Wei Jian
2026-06-10 19:53:35 +08:00
parent 40a01827cd
commit b73af73f4d
12 changed files with 232 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
components/bt/host/bluedroid/api/esp_gap_ble_api.c
View File

@@ -15,6 +15,9 @@
#include "btc/btc_ble_storage.h"
#include "esp_random.h"
/* Hard upper bound to prevent excessive allocations in BTC/BTA layers. */
#define ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN 1650U
esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
{
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -158,7 +161,22 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
ESP_BLE_IS_VALID_PARAM(params->max_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
ESP_BLE_IS_VALID_PARAM(params->timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
(params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
((params->timeout * 10) >= ((1 + params->latency) * ((params->max_int * 5) >> 1))) && params->min_int <= params->max_int) {
/*
* Core Spec (Vol 6, Part B, Section 4.5.2):
* supervision_timeout shall be strictly greater than
* (1 + connSlaveLatency) * connIntervalMax * 2.
*
* Here:
* - timeout is in 10 ms units
* - max_int is in 1.25 ms units
*
* Convert both sides into 0.5 ms units to avoid truncation:
* (timeout * 10 ms) -> timeout * 20 (0.5 ms units)
* (max_int * 1.25 ms * 2) -> max_int * 5 (0.5 ms units)
*/
(((uint32_t)params->timeout * 20U) >
((uint32_t)(1U + (uint32_t)params->latency) * (uint32_t)params->max_int * 5U)) &&
(params->min_int <= params->max_int)) {
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
@@ -339,7 +357,7 @@ esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda
return ESP_ERR_INVALID_STATE;
}
if (!remote_bda){
return ESP_ERR_INVALID_SIZE;
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
@@ -369,7 +387,7 @@ esp_err_t esp_ble_gap_clear_whitelist(void)
esp_err_t esp_ble_gap_get_whitelist_size(uint16_t *length)
{
if (length == NULL) {
return ESP_FAIL;
return ESP_ERR_INVALID_ARG;
}
ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
btc_get_whitelist_size(length);
@@ -397,7 +415,9 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
ESP_BLE_IS_VALID_PARAM(max_conn_int, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
(slave_latency <= ESP_BLE_CONN_LATENCY_MAX) &&
((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {
(((uint32_t)supervision_tout * 20U) >
((uint32_t)(1U + (uint32_t)slave_latency) * (uint32_t)max_conn_int * 5U)) &&
(min_conn_int <= max_conn_int)) {
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
@@ -678,7 +698,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
uint32_t passkey = 0;
for(uint8_t i = 0; i < len; i++)
{
passkey += (((uint8_t *)value)[i]<<(8*i));
passkey += ((uint32_t)((const uint8_t *)value)[i] << (8U * (uint32_t)i));
}
if(passkey > 999999) {
return ESP_ERR_INVALID_ARG;
@@ -846,6 +866,15 @@ esp_err_t esp_ble_get_bond_device_list(int *dev_num, esp_ble_bond_dev_t *dev_lis
*dev_num = dev_num_total;
}
/*
* The storage layer updates some fields using |= (e.g. key_mask). Ensure
* the caller-provided list is zero-initialized to avoid propagating
* uninitialized heap contents (including padding) back to the caller.
*/
if (*dev_num > 0) {
memset(dev_list, 0, sizeof(*dev_list) * (size_t)(*dev_num));
}
ret = btc_storage_get_bonded_ble_devices_list(dev_list, *dev_num);
return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -1293,6 +1322,10 @@ esp_err_t esp_ble_gap_config_ext_adv_data_raw(uint8_t instance, uint16_t length,
return ESP_ERR_INVALID_ARG;
}
if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
@@ -1319,6 +1352,10 @@ esp_err_t esp_ble_gap_config_ext_scan_rsp_data_raw(uint8_t instance, uint16_t le
return ESP_ERR_INVALID_ARG;
}
if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
msg.act = BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW;
@@ -1454,6 +1491,10 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le
return ESP_ERR_INVALID_ARG;
}
if (length > ESP_GAP_BLE_EXT_ADV_DATA_MAX_LEN) {
return ESP_ERR_INVALID_ARG;
}
msg.sig = BTC_SIG_API_CALL;
msg.pid = BTC_PID_GAP_BLE;
@@ -1751,7 +1792,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
(phy_1m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
((phy_1m_conn_params->supervision_timeout * 10) >= ((1 + phy_1m_conn_params->latency) * ((phy_1m_conn_params->interval_max * 5) >> 1))) &&
(((uint32_t)phy_1m_conn_params->supervision_timeout * 20U) >
((uint32_t)(1U + (uint32_t)phy_1m_conn_params->latency) * (uint32_t)phy_1m_conn_params->interval_max * 5U)) &&
(phy_1m_conn_params->interval_min <= phy_1m_conn_params->interval_max)) {
memcpy(&arg.set_ext_conn_params.phy_1m_conn_params, phy_1m_conn_params, sizeof(esp_ble_gap_conn_params_t));
@@ -1775,7 +1817,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
(phy_2m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
((phy_2m_conn_params->supervision_timeout * 10) >= ((1 + phy_2m_conn_params->latency) * ((phy_2m_conn_params->interval_max * 5) >> 1))) &&
(((uint32_t)phy_2m_conn_params->supervision_timeout * 20U) >
((uint32_t)(1U + (uint32_t)phy_2m_conn_params->latency) * (uint32_t)phy_2m_conn_params->interval_max * 5U)) &&
(phy_2m_conn_params->interval_min <= phy_2m_conn_params->interval_max)) {
memcpy(&arg.set_ext_conn_params.phy_2m_conn_params, phy_2m_conn_params, sizeof(esp_ble_gap_conn_params_t));
@@ -1799,7 +1842,8 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_max, BLE_CONN_INT_MIN_HOST_CHECK, ESP_BLE_CONN_INT_MAX) &&
ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
(phy_coded_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
((phy_coded_conn_params->supervision_timeout * 10) >= ((1 + phy_coded_conn_params->latency) * ((phy_coded_conn_params->interval_max * 5) >> 1))) &&
(((uint32_t)phy_coded_conn_params->supervision_timeout * 20U) >
((uint32_t)(1U + (uint32_t)phy_coded_conn_params->latency) * (uint32_t)phy_coded_conn_params->interval_max * 5U)) &&
(phy_coded_conn_params->interval_min <= phy_coded_conn_params->interval_max)) {
memcpy(&arg.set_ext_conn_params.phy_coded_conn_params, phy_coded_conn_params, sizeof(esp_ble_gap_conn_params_t));

6
components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
View File

@@ -2532,7 +2532,6 @@ typedef union {
*/
struct ble_cs_read_local_supp_caps_evt {
esp_bt_status_t status; /*!< Indicate channel sounding read local supported capabilities command successfully completed */
uint16_t conn_handle; /*!< Connection Handle */
uint8_t num_config_supported; /*!< Number of CS configurations supported per connection */
uint16_t max_consecutive_proc_supported; /*!< 0x0000: Support for both a fixed number of consecutive CS procedures and for an indefinite number of CS procedures until termination
0x0001 to 0xFFFF: Maximum number of consecutive CS procedures supported */
@@ -3113,6 +3112,11 @@ esp_err_t esp_ble_gap_add_device_to_resolving_list(esp_bd_addr_t peer_addr, uint
/**
* @brief This function clears the random address for the application
*
* @note This function shall not be used when:
* - Advertising is enabled,
* - Scanning is enabled, or
* - any LE connection exists / a create connection command is pending.
*
* @return
* - ESP_OK : success
* - other : failed

164
components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
View File

@@ -490,7 +490,8 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params)
tBLE_BD_ADDR peer_addr;
esp_bt_status_t status = ESP_BT_STATUS_SUCCESS;
if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
!BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
!BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
ble_adv_params->adv_int_min > ble_adv_params->adv_int_max) {
status = ESP_BT_STATUS_PARM_INVALID;
BTC_TRACE_ERROR("Invalid advertisting interval parameters.\n");
}
@@ -563,7 +564,8 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params)
BLE_ISVALID_PARAM(scan_params->own_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RPA_RANDOM) &&
BLE_ISVALID_PARAM(scan_params->scan_filter_policy, BLE_SCAN_FILTER_ALLOW_ALL, BLE_SCAN_FILTER_ALLOW_WLIST_RPA_DIR) &&
BLE_ISVALID_PARAM(scan_params->scan_duplicate, BLE_SCAN_DUPLICATE_DISABLE, BLE_SCAN_DUPLICATE_MAX -1) &&
(scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS)) {
(scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS) &&
scan_params->scan_window <= scan_params->scan_interval) {
BTA_DmSetBleScanFilterParams(ESP_DEFAULT_GATT_IF, /*client_if*/
scan_params->scan_interval,
scan_params->scan_window,
@@ -934,7 +936,7 @@ static void btc_read_ble_rssi_cmpl_callback(void *p_data)
static void btc_ble_read_channel_map_callback(void *p_data)
{
tBTA_BLE_CH_MAP_RESULTS *result = (tBTA_BLE_CH_MAP_RESULTS *)p_data;
esp_ble_gap_cb_param_t param;
esp_ble_gap_cb_param_t param = {0};
bt_status_t ret;
btc_msg_t msg = {0};
@@ -1227,7 +1229,14 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
#if (BLE_50_EXTEND_SCAN_EN == TRUE)
case BTA_DM_BLE_5_GAP_EXT_ADV_REPORT_EVT:
msg.act = ESP_GAP_BLE_EXT_ADV_REPORT_EVT;
memcpy(&param.ext_adv_report.params, &params->ext_adv_report, sizeof(esp_ble_gap_ext_adv_report_t));
memcpy(&param.ext_adv_report.params, &params->ext_adv_report, sizeof(tBTM_BLE_EXT_ADV_REPORT));
/* The source struct ends with a pointer (UINT8 *adv_data) while the destination
* ends with a fixed array (uint8_t adv_data[251]). The memcpy above leaves the
* raw pointer bytes at the start of adv_data[]. Clear it before copying the real
* advertising payload to avoid leaking stale pointer bytes when adv_data is NULL
* or adv_data_len is smaller than sizeof(void *). */
memset(param.ext_adv_report.params.adv_data, 0,
sizeof(param.ext_adv_report.params.adv_data));
if (params->ext_adv_report.adv_data) {
memcpy(param.ext_adv_report.params.adv_data,
params->ext_adv_report.adv_data, params->ext_adv_report.adv_data_len);
@@ -1481,7 +1490,6 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
case BTA_BLE_GAP_CS_READ_LOCAL_SUPP_CAPS_EVT:
msg.act = ESP_GAP_BLE_CS_READ_LOCAL_SUPP_CAPS_EVT;
param.cs_read_local_supp_caps.status = btc_btm_status_to_esp_status(params->cs_read_local_supp_caps.status);
param.cs_read_local_supp_caps.conn_handle = params->cs_read_local_supp_caps.conn_handle;
param.cs_read_local_supp_caps.num_config_supported = params->cs_read_local_supp_caps.num_config_supported;
param.cs_read_local_supp_caps.max_consecutive_proc_supported = params->cs_read_local_supp_caps.max_consecutive_proc_supported;
param.cs_read_local_supp_caps.num_ant_supported = params->cs_read_local_supp_caps.num_ant_supported;
@@ -1646,12 +1654,12 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
#if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
void btc_dtm_tx_start_callback(void *p1)
void btc_dtm_tx_start_callback(UINT8 *p1, UINT16 len)
{
UINT8 status;
UINT8 *p;
p = (UINT8*) p1;
if (p1) {
if (p1 && len >= 1) {
STREAM_TO_UINT8(status, p);
BTC_TRACE_DEBUG("DTM TX start, status 0x%x\n", status);
esp_ble_gap_cb_param_t param;
@@ -1673,13 +1681,13 @@ void btc_dtm_tx_start_callback(void *p1)
}
}
void btc_dtm_rx_start_callback(void *p1)
void btc_dtm_rx_start_callback(UINT8 *p1, UINT16 len)
{
UINT8 status;
UINT8 *p;
p = (UINT8*) p1;
if (p1) {
if (p1 && len >= 1) {
STREAM_TO_UINT8(status, p);
BTC_TRACE_DEBUG("DTM RX start, status 0x%x\n", status);
esp_ble_gap_cb_param_t param;
@@ -1703,13 +1711,13 @@ void btc_dtm_rx_start_callback(void *p1)
#endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
#if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
void btc_dtm_stop_callback(void *p1)
void btc_dtm_stop_callback(UINT8 *p1, UINT16 len)
{
UINT8 status;
UINT16 num_pkt;
UINT8 *p;
p = (UINT8*) p1;
if (p1) {
if (p1 && len >= 3) {
STREAM_TO_UINT8(status, p);
STREAM_TO_UINT16(num_pkt, p);
BTC_TRACE_DEBUG("DTM stop, status 0x%x num_pkt %d\n", status, num_pkt);
@@ -1874,6 +1882,13 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
btc_msg_t msg = {0};
esp_ble_vendor_evt_param_t *evt_param = &param.vendor_hci_evt.param;
bool copy_param = false;
bool parse_ok = true;
if (param_len && params == NULL) {
BTC_TRACE_WARNING("%s vendor evt NULL: sub=0x%02x len=%u",
__func__, subevt_code, param_len);
return;
}
msg.sig = BTC_SIG_API_CB;
msg.pid = BTC_PID_GAP_BLE;
@@ -1885,6 +1900,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
switch (subevt_code) {
case BLE_VENDOR_PDU_RECV_EVT:
param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_PDU_RECV_EVT;
if (param_len < (UINT8)(1 + 1 + 1 + BD_ADDR_LEN)) {
BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u",
__func__, subevt_code, param_len, (unsigned)(1 + 1 + 1 + BD_ADDR_LEN));
parse_ok = false;
break;
}
STREAM_TO_UINT8(evt_param->pdu_recv.type, params);
STREAM_TO_UINT8(evt_param->pdu_recv.handle, params);
STREAM_TO_UINT8(evt_param->pdu_recv.addr_type, params);
@@ -1892,6 +1913,12 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
break;
case BLE_VENDOR_CHMAP_UPDATE_EVT:
param.vendor_hci_evt.subevt_code = ESP_BLE_VENDOR_CHAN_MAP_UPDATE_EVT;
if (param_len < (UINT8)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN)) {
BTC_TRACE_WARNING("%s vendor trunc: sub=0x%02x len=%u<%u",
__func__, subevt_code, param_len, (unsigned)(1 + 2 + ESP_GAP_BLE_CHANNELS_LEN));
parse_ok = false;
break;
}
STREAM_TO_UINT8(evt_param->chan_map_update.status, params);
STREAM_TO_UINT16(evt_param->chan_map_update.conn_handle, params);
REVERSE_STREAM_TO_ARRAY(evt_param->chan_map_update.ch_map, params, ESP_GAP_BLE_CHANNELS_LEN);
@@ -1905,6 +1932,17 @@ static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len
break;
}
if (!parse_ok) {
/* Malformed/truncated parameters: keep the mapped esp_ble_vendor_evt_t
* already assigned in the switch (do NOT restore the raw HCI subevent
* code, which is outside esp_ble_vendor_evt_t and would break the
* public API contract). Zero the structured fields and suppress the
* internal raw buffer so the callback delivers a deterministic event;
* the truncation has already been logged above. */
memset(evt_param, 0, sizeof(*evt_param));
copy_param = false;
}
if (copy_param) {
param.vendor_hci_evt.param_len = param_len;
param.vendor_hci_evt.param_buf = (param_len) ? params : NULL;
@@ -2138,20 +2176,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
if (src->cfg_adv_data.adv_data.p_manufacturer_data) {
/* btc_transfer_context() does a shallow memcpy first; always null-out
* pointer fields so deep_free() never frees non-owned memory on OOM. */
dst->cfg_adv_data.adv_data.p_manufacturer_data = NULL;
dst->cfg_adv_data.adv_data.p_service_data = NULL;
dst->cfg_adv_data.adv_data.p_service_uuid = NULL;
if (src->cfg_adv_data.adv_data.p_manufacturer_data && src->cfg_adv_data.adv_data.manufacturer_len) {
dst->cfg_adv_data.adv_data.p_manufacturer_data = osi_malloc(src->cfg_adv_data.adv_data.manufacturer_len);
memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data,
src->cfg_adv_data.adv_data.manufacturer_len);
if (dst->cfg_adv_data.adv_data.p_manufacturer_data) {
memcpy(dst->cfg_adv_data.adv_data.p_manufacturer_data, src->cfg_adv_data.adv_data.p_manufacturer_data,
src->cfg_adv_data.adv_data.manufacturer_len);
} else {
BTC_TRACE_WARNING("%s no mem, manu drop %u", __func__, src->cfg_adv_data.adv_data.manufacturer_len);
}
}
if (src->cfg_adv_data.adv_data.p_service_data) {
if (src->cfg_adv_data.adv_data.p_service_data && src->cfg_adv_data.adv_data.service_data_len) {
dst->cfg_adv_data.adv_data.p_service_data = osi_malloc(src->cfg_adv_data.adv_data.service_data_len);
memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len);
if (dst->cfg_adv_data.adv_data.p_service_data) {
memcpy(dst->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.p_service_data, src->cfg_adv_data.adv_data.service_data_len);
} else {
BTC_TRACE_WARNING("%s no mem, svc_data drop %u", __func__, src->cfg_adv_data.adv_data.service_data_len);
}
}
if (src->cfg_adv_data.adv_data.p_service_uuid) {
if (src->cfg_adv_data.adv_data.p_service_uuid && src->cfg_adv_data.adv_data.service_uuid_len) {
dst->cfg_adv_data.adv_data.p_service_uuid = osi_malloc(src->cfg_adv_data.adv_data.service_uuid_len);
memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len);
if (dst->cfg_adv_data.adv_data.p_service_uuid) {
memcpy(dst->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.p_service_uuid, src->cfg_adv_data.adv_data.service_uuid_len);
} else {
BTC_TRACE_WARNING("%s no mem, svc_uuid drop %u", __func__, src->cfg_adv_data.adv_data.service_uuid_len);
}
}
break;
}
@@ -2159,10 +2215,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
dst->cfg_adv_data_raw.raw_adv = NULL;
dst->cfg_adv_data_raw.raw_adv_len = 0;
if (src && src->cfg_adv_data_raw.raw_adv && src->cfg_adv_data_raw.raw_adv_len > 0) {
dst->cfg_adv_data_raw.raw_adv = osi_malloc(src->cfg_adv_data_raw.raw_adv_len);
if (dst->cfg_adv_data_raw.raw_adv) {
memcpy(dst->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv, src->cfg_adv_data_raw.raw_adv_len);
dst->cfg_adv_data_raw.raw_adv_len = src->cfg_adv_data_raw.raw_adv_len;
}
}
break;
@@ -2171,10 +2230,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
dst->cfg_scan_rsp_data_raw.raw_scan_rsp = NULL;
dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = 0;
if (src && src->cfg_scan_rsp_data_raw.raw_scan_rsp && src->cfg_scan_rsp_data_raw.raw_scan_rsp_len > 0) {
dst->cfg_scan_rsp_data_raw.raw_scan_rsp = osi_malloc(src->cfg_scan_rsp_data_raw.raw_scan_rsp_len);
if (dst->cfg_scan_rsp_data_raw.raw_scan_rsp) {
memcpy(dst->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp_len);
dst->cfg_scan_rsp_data_raw.raw_scan_rsp_len = src->cfg_scan_rsp_data_raw.raw_scan_rsp_len;
}
}
break;
@@ -2185,6 +2247,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
uint8_t length = 0;
dst->set_security_param.value = NULL;
if (src->set_security_param.value) {
length = dst->set_security_param.len;
dst->set_security_param.value = osi_malloc(length);
@@ -2192,6 +2255,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
memcpy(dst->set_security_param.value, src->set_security_param.value, length);
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
dst->set_security_param.len = 0;
}
}
break;
@@ -2200,6 +2264,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *) p_dest;
uint8_t length = 0;
dst->oob_req_reply.p_value = NULL;
if (src->oob_req_reply.p_value) {
length = dst->oob_req_reply.len;
dst->oob_req_reply.p_value = osi_malloc(length);
@@ -2207,6 +2272,7 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
memcpy(dst->oob_req_reply.p_value, src->oob_req_reply.p_value, length);
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
dst->oob_req_reply.len = 0;
}
}
break;
@@ -2214,6 +2280,8 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT: {
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
dst->sc_oob_req_reply.p_c = NULL;
dst->sc_oob_req_reply.p_r = NULL;
if (src->sc_oob_req_reply.p_c) {
dst->sc_oob_req_reply.p_c = osi_malloc(BT_OCTET16_LEN);
if (dst->sc_oob_req_reply.p_c) {
@@ -2234,17 +2302,38 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
}
#if (BLE_50_FEATURE_SUPPORT == TRUE)
#if (BLE_50_EXTEND_ADV_EN == TRUE)
case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: {
btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src;
btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
uint16_t length = 0;
dst->ext_adv_cfg_data.data = NULL;
dst->ext_adv_cfg_data.length = 0;
if (src->ext_adv_cfg_data.data) {
length = src->ext_adv_cfg_data.length;
dst->ext_adv_cfg_data.data = osi_malloc(length);
if (dst->ext_adv_cfg_data.data) {
memcpy(dst->ext_adv_cfg_data.data, src->ext_adv_cfg_data.data, length);
dst->ext_adv_cfg_data.length = length;
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
}
}
break;
}
case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
btc_ble_5_gap_args_t *src = (btc_ble_5_gap_args_t *)p_src;
btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
uint16_t length = 0;
dst->cfg_scan_rsp.data = NULL;
dst->cfg_scan_rsp.length = 0;
if (src->cfg_scan_rsp.data) {
length = src->cfg_scan_rsp.length;
dst->cfg_scan_rsp.data = osi_malloc(length);
if (dst->cfg_scan_rsp.data) {
memcpy(dst->cfg_scan_rsp.data, src->cfg_scan_rsp.data, length);
dst->cfg_scan_rsp.length = length;
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
}
@@ -2258,17 +2347,17 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
btc_ble_5_gap_args_t *dst = (btc_ble_5_gap_args_t *)p_dest;
uint16_t length = 0;
dst->periodic_adv_cfg_data.data = NULL;
dst->periodic_adv_cfg_data.len = 0;
if (src->periodic_adv_cfg_data.data) {
length = src->periodic_adv_cfg_data.len;
dst->periodic_adv_cfg_data.data = osi_malloc(length);
if (dst->periodic_adv_cfg_data.data) {
memcpy(dst->periodic_adv_cfg_data.data, src->periodic_adv_cfg_data.data, length);
dst->periodic_adv_cfg_data.len = length;
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
}
} else {
dst->periodic_adv_cfg_data.data = NULL;
dst->periodic_adv_cfg_data.len = 0;
}
break;
}
@@ -2306,10 +2395,13 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: {
btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
dst->vendor_cmd_send.p_param_buf = NULL;
dst->vendor_cmd_send.param_len = 0;
if (src->vendor_cmd_send.param_len) {
dst->vendor_cmd_send.p_param_buf = osi_malloc(src->vendor_cmd_send.param_len);
if (dst->vendor_cmd_send.p_param_buf) {
memcpy(dst->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.param_len);
dst->vendor_cmd_send.param_len = src->vendor_cmd_send.param_len;
} else {
BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
}
@@ -2396,11 +2488,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
switch (msg->act) {
case ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT: {
dst->vendor_cmd_cmpl.p_param_buf = NULL;
dst->vendor_cmd_cmpl.param_len = 0;
if (src->vendor_cmd_cmpl.param_len) {
dst->vendor_cmd_cmpl.p_param_buf = osi_malloc(src->vendor_cmd_cmpl.param_len);
if (dst->vendor_cmd_cmpl.p_param_buf) {
memcpy(dst->vendor_cmd_cmpl.p_param_buf, src->vendor_cmd_cmpl.p_param_buf,
src->vendor_cmd_cmpl.param_len);
dst->vendor_cmd_cmpl.param_len = src->vendor_cmd_cmpl.param_len;
} else {
BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
}
@@ -2408,11 +2503,14 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
break;
}
case ESP_GAP_BLE_VENDOR_HCI_EVT: {
dst->vendor_hci_evt.param_buf = NULL;
dst->vendor_hci_evt.param_len = 0;
if (src->vendor_hci_evt.param_len) {
dst->vendor_hci_evt.param_buf = osi_malloc(src->vendor_hci_evt.param_len);
if (dst->vendor_hci_evt.param_buf) {
memcpy(dst->vendor_hci_evt.param_buf, src->vendor_hci_evt.param_buf,
src->vendor_hci_evt.param_len);
dst->vendor_hci_evt.param_len = src->vendor_hci_evt.param_len;
} else {
BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
}
@@ -2474,7 +2572,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
}
}
} else {
BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__);
BTC_TRACE_ERROR("%s, step_info, no enough memory.", __func__);
}
}
break;
@@ -2497,7 +2595,7 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
}
}
} else {
BTC_TRACE_ERROR("%s, pa_rsp_info, no enough memory.", __func__);
BTC_TRACE_ERROR("%s, continue step_info, no enough memory.", __func__);
}
}
break;
@@ -2572,14 +2670,20 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg)
}
#if (BLE_50_FEATURE_SUPPORT == TRUE)
#if (BLE_50_EXTEND_ADV_EN == TRUE)
case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW: {
uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->ext_adv_cfg_data.data;
if (value) {
osi_free(value);
}
break;
}
case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
uint8_t *value = ((btc_ble_5_gap_args_t *)msg->arg)->cfg_scan_rsp.data;
if (value) {
osi_free(value);
}
break;
}
#endif // #if (BLE_50_EXTEND_ADV_EN == TRUE)
#if (BLE_50_PERIODIC_ADV_EN == TRUE)
case BTC_GAP_BLE_CFG_PERIODIC_ADV_DATA_RAW: {
@@ -3031,9 +3135,9 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
break;
case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW:
BTC_TRACE_DEBUG("BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW");
BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->ext_adv_cfg_data.instance,
arg_5->ext_adv_cfg_data.length,
(const UINT8 *)arg_5->ext_adv_cfg_data.data);
BTA_DmBleGapConfigExtAdvDataRaw(TRUE, arg_5->cfg_scan_rsp.instance,
arg_5->cfg_scan_rsp.length,
(const UINT8 *)arg_5->cfg_scan_rsp.data);
break;
case BTC_GAP_BLE_EXT_ADV_START: {
BTC_TRACE_DEBUG("BTC_GAP_BLE_EXT_ADV_START");

6
components/bt/host/bluedroid/stack/btm/btm_acl.c
View File

@@ -2279,7 +2279,7 @@ void btm_acl_pkt_types_changed(UINT8 status, UINT16 handle, UINT16 pkt_types)
tBTM_STATUS BTM_ReadChannelMap(BD_ADDR remote_bda)
{
tACL_CONN *p;
tBTM_BLE_CH_MAP_RESULTS result;
tBTM_BLE_CH_MAP_RESULTS result = {0};
tBTM_BLE_LEGACY_GAP_CB_PARAMS cb_params;
UINT8 status;
@@ -2322,7 +2322,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
{
tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
if (p_cb->white_list_avail_size == 0) {
BTM_TRACE_WARNING("%s Whitelist full.", __func__);
BTM_TRACE_WARNING("%s Whitelist size is 0.", __func__);
}
*length = p_cb->white_list_avail_size;
return;
@@ -2356,7 +2356,7 @@ void BTM_BleGetPeriodicAdvListSize(uint8_t *size)
*******************************************************************************/
void btm_read_channel_map_complete(UINT8 *p)
{
tBTM_BLE_CH_MAP_RESULTS results;
tBTM_BLE_CH_MAP_RESULTS results = {0};
UINT16 handle;
tACL_CONN *p_acl_cb = NULL;

16
components/bt/host/bluedroid/stack/btm/btm_ble.c
View File

@@ -736,7 +736,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran
** p_cmd_cmpl_cback - Command Complete callback
**
*******************************************************************************/
void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback)
void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
{
btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
@@ -758,7 +758,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback)
**
*******************************************************************************/
void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback)
UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
{
btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
if (btsnd_hcic_ble_transmitter_test(tx_freq, test_data_len, packet_payload) == FALSE) {
@@ -776,7 +776,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
** Parameter p_cmd_cmpl_cback - Command complete callback
**
*******************************************************************************/
void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback)
void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
{
btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
@@ -788,14 +788,14 @@ void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback)
/*******************************************************************************
** Internal Functions
*******************************************************************************/
void btm_ble_test_command_complete(UINT8 *p)
void btm_ble_test_command_complete(UINT8 *p, UINT16 len)
{
tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb;
tBTM_DTM_CMD_CMPL_CBACK *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb;
btm_cb.devcb.p_le_test_cmd_cmpl_cb = NULL;
if (p_cb) {
(*p_cb)(p);
(*p_cb)(p, len);
}
}
#endif // #if ((BLE_42_DTM_TEST_EN == TRUE) || (BLE_50_DTM_TEST_EN == TRUE))
@@ -813,7 +813,7 @@ void btm_ble_test_command_complete(UINT8 *p)
** p_cmd_cmpl_cback - Command Complete callback
**
*******************************************************************************/
void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback)
void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
{
btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
@@ -836,7 +836,7 @@ void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_inde
**
*******************************************************************************/
void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback)
UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback)
{
btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
if (btsnd_hcic_ble_enhand_tx_test(tx_freq, test_data_len, packet_payload, phy) == FALSE) {

6
components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c
View File

@@ -334,13 +334,13 @@ tBTM_STATUS BTM_BleConfigExtendedAdvDataRaw(BOOLEAN is_scan_rsp, UINT8 instance,
}
}
if (!is_scan_rsp) {
if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) {
if ((err = btsnd_hcic_ble_set_ext_adv_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) {
BTM_TRACE_ERROR("LE EA SetAdvData: cmd err=0x%x", err);
status = BTM_HCI_ERROR | err;
break;
}
} else {
if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, &data[data_offset])) != HCI_SUCCESS) {
if ((err = btsnd_hcic_ble_set_ext_adv_scan_rsp_data(instance, operation, 0, send_data_len, (data == NULL) ? NULL : &data[data_offset])) != HCI_SUCCESS) {
BTM_TRACE_ERROR("LE EA SetScanRspData: cmd err=0x%x", err);
status = BTM_HCI_ERROR | err;
break;
@@ -1900,7 +1900,6 @@ void btm_ble_cs_read_local_supp_caps_cmpl_evt(uint8_t *p)
goto _error;
}
STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.conn_handle, p);
STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_config_supported, p);
STREAM_TO_UINT16(cb_params.cs_read_local_supp_caps.max_consecutive_proc_supported, p);
STREAM_TO_UINT8(cb_params.cs_read_local_supp_caps.num_ant_supported, p);
@@ -2011,6 +2010,7 @@ void btm_ble_cs_read_remote_fae_table_cmd_status(UINT8 status)
tBTM_BLE_CS_READ_REMOTE_FAE_TAB_CMPL_EVT cs_read_remote_fae_tab = {0};
if (status != HCI_SUCCESS) {
cs_read_remote_fae_tab.status = (status | BTM_HCI_ERROR);
cs_read_remote_fae_tab.conn_handle = 0xFFFF;
BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_READ_REMOTE_FAE_TABLE_CMPL_EVT, (tBTM_BLE_5_GAP_CB_PARAMS *)&cs_read_remote_fae_tab);
}
}

3
components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c
View File

@@ -1180,6 +1180,9 @@ void btm_ble_resolving_list_cleanup(void)
{
tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
p_q->q_next = 0;
p_q->q_pending = 0;
if (p_q->resolve_q_random_pseudo) {
osi_free(p_q->resolve_q_random_pseudo);
p_q->resolve_q_random_pseudo = NULL;

16
components/bt/host/bluedroid/stack/btm/btm_devctl.c
View File

@@ -120,13 +120,11 @@ void btm_dev_init (void)
*******************************************************************************/
static void btm_db_reset (void)
{
tBTM_CMPL_CB *p_cb;
tBTM_STATUS status = BTM_DEV_RESET;
btm_inq_db_reset();
#if (CLASSIC_BT_INCLUDED == TRUE)
if (btm_cb.devcb.p_rln_cmpl_cb) {
tBTM_CMPL_CB *p_cb;
p_cb = btm_cb.devcb.p_rln_cmpl_cb;
btm_cb.devcb.p_rln_cmpl_cb = NULL;
@@ -137,12 +135,14 @@ static void btm_db_reset (void)
#endif // (CLASSIC_BT_INCLUDED == TRUE)
if (btm_cb.devcb.p_rssi_cmpl_cb) {
p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
btm_cb.devcb.p_rssi_cmpl_cb = NULL;
tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
tBTM_RSSI_RESULTS results = {0};
if (p_cb) {
(*p_cb)((tBTM_RSSI_RESULTS *) &status);
}
results.status = BTM_DEV_RESET;
btm_cb.devcb.p_rssi_cmpl_cb = NULL;
btu_stop_timer(&btm_cb.devcb.rssi_timer);
(*p_cb)(&results);
}
}

2
components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h
View File

@@ -444,7 +444,7 @@ void btm_ble_increment_sign_ctr(BD_ADDR bd_addr, BOOLEAN is_local );
BOOLEAN btm_get_local_div (BD_ADDR bd_addr, UINT16 *p_div);
BOOLEAN btm_ble_get_enc_key_type(BD_ADDR bd_addr, UINT8 *p_key_types);
void btm_ble_test_command_complete(UINT8 *p);
void btm_ble_test_command_complete(UINT8 *p, UINT16 len);
void btm_ble_rand_enc_complete (UINT8 *p, UINT16 op_code, tBTM_RAND_ENC_CB *p_enc_cplt_cback);
void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY_VALUE *p_keys, BOOLEAN pass_to_application);

4
components/bt/host/bluedroid/stack/btm/include/btm_int.h
View File

@@ -289,8 +289,8 @@ DEV_CLASS dev_class; /* Local device class
TIMER_LIST_ENT ble_channels_timer;
tBTM_CMPL_CB *p_le_test_cmd_cmpl_cb; /* Callback function to be called when
LE test mode command has been sent successfully */
tBTM_DTM_CMD_CMPL_CBACK *p_le_test_cmd_cmpl_cb; /* Callback function to be called when
LE test mode command has been sent successfully */
BD_ADDR read_tx_pwr_addr; /* read TX power target address */

9
components/bt/host/bluedroid/stack/include/stack/btm_api.h
View File

@@ -173,7 +173,14 @@ typedef void (tBTM_VSC_CMPL_CB) (tBTM_VSC_CMPL *p1);
*/
// typedef UINT8 (tBTM_FILTER_CB) (BD_ADDR bd_addr, DEV_CLASS dc);
typedef void (tBTM_DTM_CMD_CMPL_CBACK) (void *p1);
/*
* DTM (Direct Test Mode) command complete callback.
*
* The controller returns a variable-length parameter block depending on the
* specific LE test command. Propagate the parameter length so upper layers can
* validate before parsing and avoid OOB reads on malformed/truncated responses.
*/
typedef void (tBTM_DTM_CMD_CMPL_CBACK) (UINT8 *p, UINT16 len);
typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);

11
components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h
View File

@@ -1528,7 +1528,6 @@ typedef struct {
typedef struct {
UINT8 status;
UINT16 conn_handle;
UINT8 num_config_supported;
UINT16 max_consecutive_proc_supported;
UINT8 num_ant_supported;
@@ -2726,7 +2725,7 @@ void BTM_BleClearWhitelist(void);
** p_cmd_cmpl_cback - Command Complete callback
**
*******************************************************************************/
void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback);
void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
/*******************************************************************************
@@ -2742,7 +2741,7 @@ void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback);
**
*******************************************************************************/
void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback);
UINT8 packet_payload, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
/*******************************************************************************
**
@@ -2753,7 +2752,7 @@ void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
** Parameter p_cmd_cmpl_cback - Command complete callback
**
*******************************************************************************/
void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback);
void BTM_BleTestEnd(tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
/*******************************************************************************
**
@@ -3087,9 +3086,9 @@ tBTM_STATUS BTM_BleEnableMonitorAdv(UINT8 enable);
#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
#if (BLE_50_DTM_TEST_EN == TRUE)
void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback);
void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback);
void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_DTM_CMD_CMPL_CBACK *p_cmd_cmpl_cback);
#endif // #if (BLE_50_DTM_TEST_EN == TRUE)
#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)