Initialize and deinitialize BLE Log from the Bluedroid host lifecycle when the local
controller is disabled. Guard controller mbuf handling with BLE_LOG_LL_ENABLED so host-
only builds do not depend on controller headers.
Update NimBLE to b6e2f93db269ad2bba8715953cb56f93bae4fc2f to provide the corresponding
host-only initialization. Combine the host initialization fix and the final NimBLE
revision into one prerequisite commit.
Cancel in-flight SDP searches before freeing discovery databases in BTA AV
and HID Host. Otherwise a late SDP response can be parsed into a freed
buffer after esp_a2d_*_deinit / HID host disable, the same class of
corruption as JV/SPP deinit.
Co-authored-by: Cursor <cursoragent@cursor.com>
bta_jv_disable() reset the control block and let BTA_JvFree() release
p_sdp_db/p_sdp_raw_data while an SDP service search could still be in
progress. Late SDP responses were then parsed into the freed discovery
database and corrupted the heap, so the crash surfaced much later in an
unrelated malloc(), inside TLSF remove_free_block().
Cancel the search first. SDP_CancelServiceSearch() moves the connection
control block to SDP_DISC_WAIT_CANCEL, and sdp_disc_server_rsp() matches
none of its PDU cases in that state, so a late response is rejected
instead of being written into the database.
Reachable from both esp_spp_deinit() and esp_bt_l2cap_deinit(), e.g. when
an application deinitializes SPP before ESP_SPP_DISCOVERY_COMP_EVT
arrives.
Fix DTM TX buffer leak in the BLE controller that could cause memory exhaustion and Interrupt WDT timeout during or after DTM TX tests. (6.0)
See merge request espressif/esp-idf!52615
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.
1. Module/source argument quoting. CMakeLists.txt passes the
semicolon-separated module and source lists wrapped in single quotes
("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
cmd.exe does not treat single quotes as quoting characters, so on
Windows the quotes reached the script literally and
args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
the clean names. These never matched the YAML module keys, every
module was skipped ("Skipping module ... - config not found"), the
compressed sources were never generated, and the build failed. Strip
surrounding quote characters before splitting; this is a no-op on
Linux/macOS where the shell already removed them.
2. CRLF line endings. With core.autocrlf=true the IDF sources are
checked out as CRLF on Windows. The generated *_log_index.h macros
use backslash-newline line-continuation; a backslash followed by
'\r\n' is not a valid continuation in C, producing floods of syntax
errors when the header is compiled. Write generated headers with
newline='' to force LF, and normalize source content to LF right
after reading so '\r' embedded inside multi-line argument expressions
is also handled. Byte offsets stay consistent because both tree-sitter
parsing and tag replacement operate on the normalized content.
Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.
(cherry picked from commit aa9b565a6d)
Co-authored-by: luoxu <luoxu@espressif.com>
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3)
Co-authored-by: luoxu <luoxu@espressif.com>
These per-event traces fire on every async dispatch and flood BT logs
without aiding diagnosis; higher-layer traces remain for debugging.
(cherry picked from commit b9b9b8633f)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
When the bond list is full, drop the oldest disconnected device instead
of the oldest NVS entry, and allow a per-bond except flag so selected
devices are never auto-removed.
(cherry picked from commit bf86892eef)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Sumeet Singh
Jiang Jiang Jian
Zhou Xiao
xiongweichaoandCursor
Astha Verma
Rahul Tank
Wang Meng Yang
linruihao
cjin
Island
Jin Cheng
Shreeyash Bhakare
hejiaxin
zhaoweiliang
luoxu
Zhang Hai Peng
chenjianhua