Zhi Wei Jian
0532d07a86
feat(ble/bluedroid): Support bluedroid dual identity
...
(cherry picked from commit 2358786647 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 14:22:39 +08:00
Zhi Wei Jian
7a80e9b127
fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders
...
(cherry picked from commit abbf001120 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:10 +08:00
Zhi Wei Jian
00960a5dac
fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure
...
(cherry picked from commit 4fd1ebb4a9 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:09 +08:00
Zhi Wei Jian
3deee8d3e2
docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked
...
(cherry picked from commit 34b59d30ae )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:08 +08:00
Zhi Wei Jian
e2735b1bb5
fix(ble/bluedroid): fix direct-connect cleanup and adv bounds
...
(cherry picked from commit 82e71c1767 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:08 +08:00
Zhi Wei Jian
1330f558e1
fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device
...
(cherry picked from commit 93ab11d564 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
fab68dc82f
fix(ble/bluedroid): validate SMP pair-fail reason and OOB device
...
(cherry picked from commit 98efe02385 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
d2f755b735
fix(ble/bluedroid): route ATT indication-conf timeout separately
...
(cherry picked from commit 6c3267ee84 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:07 +08:00
Zhi Wei Jian
12b6beff43
fix(ble/bluedroid): validate ATT PDU sizes
...
(cherry picked from commit bb00b9817d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:06 +08:00
Zhi Wei Jian
7637a46169
fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback
...
(cherry picked from commit 37562af0ea )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:06 +08:00
Zhi Wei Jian
b7fde3a96c
fix(ble/bluedroid): fix GATT long read and Service Changed CCC
...
(cherry picked from commit 4ce692ac0c )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
0b515686dd
fix(ble/bluedroid): validate GATT client discovery handles
...
(cherry picked from commit ac35ae6f2d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
b0e64dbbd5
fix(ble/bluedroid): cap Read By Type length and free failed service decl
...
(cherry picked from commit 27ff0cf8c7 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:05 +08:00
Zhi Wei Jian
af043ccffa
fix(ble/bluedroid): guard GATT database hash and serialization
...
(cherry picked from commit 995c1508e8 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
c48e5a30e9
fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling
...
(cherry picked from commit f86739b03d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
e7f6bf115e
fix(ble/bluedroid): fix GATT teardown and service-change flow
...
(cherry picked from commit 0645ba469d )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:04 +08:00
Zhi Wei Jian
a9c2816caf
fix(ble/bluedroid): fix GATT service lifecycle leaks
...
(cherry picked from commit ac93d94958 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:04:03 +08:00
Zhi Wei Jian
de2578d083
fix(ble/bluedroid): add GATT resource-cleanup helpers
...
(cherry picked from commit b83327f3ca )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 12:03:58 +08:00
Zhi Wei Jian
95bd892dba
feat(ble/bluedroid): Support bluedroid LE COC and EATT features
...
(cherry picked from commit 83f0831c53 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-07-14 11:56:02 +08:00
Wang Meng Yang
36e78269b8
Merge branch 'bugfix/bbp_issues_v5.4' into 'release/v5.4'
...
Bugfix/bbp issues v5.4
See merge request espressif/esp-idf!50191
2026-07-06 11:16:44 +08:00
Wang Meng Yang
1ce3dfb50c
Merge branch 'bugfix/ai_review_btu_common_v5.4' into 'release/v5.4'
...
fix: Fix the critical issues of btu and bt_common from AI review report (v5.4)
See merge request espressif/esp-idf!50124
2026-06-30 19:24:27 +08:00
Wang Meng Yang
d3d0963239
Merge branch 'bugfix/ai_review_a2dp_v5.4' into 'release/v5.4'
...
fix(bt): Fix the critical issues related to A2DP from AI review report (v5.4)
See merge request espressif/esp-idf!50130
2026-06-30 19:23:54 +08:00
Jin Cheng
66be8af7ee
fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd
2026-06-30 15:10:44 +08:00
Island
416cd10dd5
Merge branch 'bugfix/fix_bluedroid_static_random_conn_rpa_v5.4' into 'release/v5.4'
...
fix(ble/bluedroid): skip identity conversion for static random direct connect (5.4)
See merge request espressif/esp-idf!50083
2026-06-30 10:24:53 +08:00
yangfeng
f164a75569
fix(bt): Fix the critical issues related to A2DP from AI review report
...
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
2026-06-29 15:06:38 +08:00
yangfeng
3437c34c17
fix: Fix the critical issues of btu and bt_common from AI review report
...
- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events
2026-06-29 14:49:19 +08:00
Zhi Wei Jian
1b340fe82b
feat(ble/bluedroid): add CS Security Requirements host support (Core 6.3)
...
(cherry picked from commit 919622c01c )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian
aed8603a42
feat(ble/bluedroid): add LE UTP host support (Core 6.2)
...
(cherry picked from commit 3844e24207 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian and Cursor
661e297e87
feat(ble/bluedroid): add Shorter Connection Intervals host support (Core 6.2)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
(cherry picked from commit 2a8a96d650 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian
c72a639097
feat(ble/bluedroid): add LL Extended Feature Set host support (Core 6.0)
...
(cherry picked from commit d568f2f151 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian and Cursor
4812d74f48
feat(ble/bluedroid): add Frame Space Update host support (Core 6.0)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
(cherry picked from commit 5372ce03a3 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhi Wei Jian
5cff20ac8f
feat(ble/bluedroid): add DBAF host support (Core 6.0)
...
(cherry picked from commit e20d3f0197 )
Co-authored-by: zhiweijian <zhiweijian@espressif.com >
2026-06-26 20:37:44 +08:00
Zhang Hai Peng
ae071465e5
fix(ble/bluedroid): preserve HCI status on BLE 4.2 GAP failures
...
Return BTM_HCI_ERROR | hci_status from legacy BLE 4.2 GAP HCI command
paths instead of mapping failures to BTM_ILLEGAL_VALUE or
BTM_NO_RESOURCES. Add btm_ble_status_from_hci() helper and propagate
real status through scan start/stop completion callbacks.
(cherry picked from commit 47dd785a18 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:24:48 +08:00
Zhang Hai Peng
6d33df6d6b
feat(ble/bluedroid): Optimize Bluedroid memory usage
...
- Delete unused device records (~356B each)
(cherry picked from commit 7d1c0e9a32 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:24:27 +08:00
Zhang Hai Peng
d70c7c117b
fix(ble/bluedroid): cap Read By Type response length at ATT maximum
...
Read By Type Response Length is one octet (max 255). When MTU was
large enough to return a long characteristic value in one pair, the
server wrote (UINT8)(value_len + 2) and overflowed (e.g. 513 -> 1),
so the client rejected the PDU as GATT_INVALID_PDU (0x04).
Cap server value to 253 bytes per pair, clamp the length byte, and
continue long reads via Read Blob when the capped size is returned.
(cherry picked from commit 97905afccc )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:24:09 +08:00
Zhang Hai Peng
af18806c6a
fix(ble/bluedroid): Fixed potential double Execute Write Response
...
(cherry picked from commit 0a93ccd3b3 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:23:52 +08:00
Zhang Hai Peng
4e8432580a
fix(ble/bluedroid): unblock sync HCI cmd on Command Status error
...
Release the BLE sync semaphore and record HCI status when a
synchronous command is rejected via Command Status, since no
Command Complete event follows.
(cherry picked from commit 29ae92f4ef )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:16:43 +08:00
Zhang Hai Peng
91db334490
fix(ble/bluedroid): report conn param update failure for unknown BD_ADDR
...
Route unknown BD_ADDR and other immediate failures through the existing
need_cb path so ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT is always delivered.
(cherry picked from commit f9eaeb5e84 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:16:07 +08:00
Zhang Hai Peng
865a25c05a
fix(ble/bluedroid): reject adv data on legacy directed ext adv
...
(cherry picked from commit c339cec380 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:15:47 +08:00
Zhang Hai Peng
debbf336f4
fix(ble/bluedroid): skip identity conversion for static random direct connect
...
Do not rewrite static or non-resolvable random peer addresses to
identity type 0x03 when CONFIG_BT_BLE_RPA_SUPPORTED is enabled.
(cherry picked from commit 2ef10ef488 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-26 20:15:28 +08:00
yangfeng
2184fae05b
fix(bt): Fix the high issues related to AVRCP from AI review report
...
- SDP/registration: handle SDP record creation and discovery failures safely
- AVRC stack: fix packet checks, fragment leaks, response build, and compile guards
- BTC AVRCP: fix return codes, connection state, metadata parsing, and memory leaks
- AVCTP: fix event passing, L2CAP conflicts, TX queue leaks, and disconnect handling
- Example: remove TG RN capability setup before initialization
2026-06-25 14:58:17 +08:00
yangfeng
6c34f8140d
fix(bt): Fix the critical issues related to AVRCP from AI review report
...
- recalculate len_left per attribute in avrc_bld_app_setting_text_rsp
- abort fragmented message reassembly when reassembly buffer alloc fails
2026-06-25 14:52:36 +08:00
Zhang Hai Peng
68e37183f1
feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses
...
(cherry picked from commit 7986e2faa8 )
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com >
2026-06-18 10:24:49 +08:00
Wang Meng Yang
c4f758d14d
Merge branch 'bugfix/bbp_isses_v5.4' into 'release/v5.4'
...
Bugfix/bbp isses v5.4
See merge request espressif/esp-idf!49626
2026-06-15 12:57:48 +08:00
Jin Cheng
852a3545d1
fix(bt/bluedroid): added buffer length check for OBEX APIs
2026-06-12 18:44:19 +08:00
Jin Cheng
cc3478275e
fix(bt/bluedroid): added buffer length check for HID Device data indication
2026-06-12 18:40:06 +08:00
Jin Cheng
e7d62574f3
fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received
2026-06-12 18:40:06 +08:00
Jin Cheng
58b11e36bc
fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode
2026-06-12 18:40:06 +08:00
Jin Cheng
d544e486c9
fix(bt/bluedroid): added buffer length check for HID host data indication
2026-06-12 18:40:06 +08:00
Jin Cheng
5731c63ece
fix(bt/bluedroid): added buffer length check for L2CAP related functions
2026-06-12 18:40:06 +08:00