The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
Reset the LP SPI peripheral and GPIOs before and after every SPI case so
each test starts from a known-clean baseline, and gate the master on an
explicit slave-armed handshake so the master cannot clock the bus while
the slave is still in its arm prologue. Verify received data against the
expected pattern with bounded waits instead of merely logging it.
Add a dedicated LP SPI multi-device pytest for esp32p4 that runs the
retagged lp_core_spi cases, and tag the LP I2C case accordingly.
The LP SPI driver read and wrote the W0..W15 data buffer registers a
whole 32-bit word at a time, which overran the caller's buffer for
transfers whose length was not a multiple of four bytes and corrupted
the received data. Read and write the data buffer byte-granularly so
sub-word transfers no longer alias adjacent bytes.
The master transfer also programmed the shared bit-length register from
tx_length alone, truncating receive-longer-than-transmit transactions,
and always enabled MOSI even on read-only transfers, clocking out stale
buffer contents. Size each hardware transaction by max(tx_length,
rx_length) and gate MOSI/MISO on the corresponding buffer.
The slave path reused the master's single-shot flow, so it re-triggered
reg_update after preload (clocking out the previous transaction's data)
and offered no way for the caller to publish readiness before the master
started the clock. Split the slave transfer into an arm step that
preloads the buffer and starts the user phase, and a wait step that
blocks on TRANS_DONE and drains only the bytes the master actually
clocked in, tracked in software since reg_usr is not a reliable busy
indicator in slave mode.
Set the LP IO direction for the SPI pads, add
lp_core_lp_spi_bus_deinit() to release the LP GPIO pins, and reset the
LP SPI peripheral at bus initialization so a stale configuration from a
previous run cannot leak into the next.
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
Pointer arithmetic on rtc_retain_mem_t* subtracted ESP_SECURE_BOOT_DIGEST_LEN
in struct units instead of bytes. Cast through uintptr_t so retain mem stays
below the ROM verified-image digest region on deep-sleep wake.
Partial backport of !51265 (bootloader_common_loader.c only).
The BLE log compression feature (CONFIG_BT_LOG_CRITICAL_ONLY ->
BLE_COMPRESSED_LOG_ENABLE) failed to build on Windows while working
correctly on Linux, due to two shell/platform-specific issues in the
compression script.
1. Module/source argument quoting. CMakeLists.txt passes the
semicolon-separated module and source lists wrapped in single quotes
("'${MODULES}'") to protect ';' from POSIX shells, which strip them.
cmd.exe does not treat single quotes as quoting characters, so on
Windows the quotes reached the script literally and
args.module.split(';') produced "'BLE_MESH" / "BLE_HOST'" instead of
the clean names. These never matched the YAML module keys, every
module was skipped ("Skipping module ... - config not found"), the
compressed sources were never generated, and the build failed. Strip
surrounding quote characters before splitting; this is a no-op on
Linux/macOS where the shell already removed them.
2. CRLF line endings. With core.autocrlf=true the IDF sources are
checked out as CRLF on Windows. The generated *_log_index.h macros
use backslash-newline line-continuation; a backslash followed by
'\r\n' is not a valid continuation in C, producing floods of syntax
errors when the header is compiled. Write generated headers with
newline='' to force LF, and normalize source content to LF right
after reading so '\r' embedded inside multi-line argument expressions
is also handled. Byte offsets stay consistent because both tree-sitter
parsing and tag replacement operate on the normalized content.
Verified by full clean builds of examples/bluetooth/esp_ble_mesh/
vendor_models/vendor_client (esp32c6, bluedroid + mesh) from both
cmd.exe and PowerShell; both produce an identical vendor_client.bin.
(cherry picked from commit aa9b565a6d)
Co-authored-by: luoxu <luoxu@espressif.com>
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
sonika.rathi
Akshat Agrawal
harshal.patil
Island
Rahul Tank
zwx
hejiaxin
Jiang Jiang Jian
Chen Jichang
cjin
Sudeep Mohanty
morris
zhangyanjiao
Jin Cheng
Alexey Gerenkov
wuzhenghui
Wang Meng Yang
Hu Rui
Luo Xu
chenjianhua
Li Shuai
Alexey Lapshin
Xu Si Yu