Commit Graph

667 Commits

Author SHA1 Message Date
zhanghaipeng
72a49ed53b fix(ble/bluedroid): downgrade numeric comparison log to warning 2026-07-08 11:03:36 +08:00
zhanghaipeng
31bd80fee8 fix(ble/bluedroid): preserve ext adv state when set params fails
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.
2026-07-08 10:53:56 +08:00
Jiang Jiang Jian
ae860abd4c Merge branch 'bugfix/ai_review_btu_common' into 'master'
fix: Fix the critical issues of btu and bt_common from AI review report

See merge request espressif/esp-idf!49574
2026-06-29 12:00:22 +08:00
Jiang Jiang Jian
af7e18f9d0 Merge branch 'bugfix/ai_review_a2dp' into 'master'
fix(bt): Fix the critical issues related to A2DP from AI review report

See merge request espressif/esp-idf!49355
2026-06-29 11:58:39 +08:00
Island
83c7c6ed82 Merge branch 'bugfix/fix_ble_write_fail' into 'master'
fix(ble/bluedroid): Fixed potential double Execute Write Response

Closes BLERP-2292

See merge request espressif/esp-idf!49413
2026-06-26 20:08:29 +08:00
Island
3fe6482c51 Merge branch 'bugfix/fix_ble_sync_cmd_command_status_err' into 'master'
fix(ble/bluedroid): unblock sync HCI cmd on Command Status error

Closes BLERP-2926

See merge request espressif/esp-idf!49965
2026-06-26 16:52:18 +08:00
Island
b45f379fd1 Merge branch 'bugfix/fix_bluedroid_read_by_type_fail' into 'master'
fix(ble/bluedroid): cap Read By Type response length at ATT maximum

Closes BLERP-2895, BLERP-2896, and BLERP-2897

See merge request espressif/esp-idf!49656
2026-06-26 16:51:19 +08:00
Island
ba17bb5c6f Merge branch 'opt/opt_bluedroid_memory' into 'master'
feat(ble/bluedroid): Optimize Bluedroid memory usage

Closes BLERP-2307

See merge request espressif/esp-idf!49666
2026-06-26 16:51:12 +08:00
Island
96234ffa93 Merge branch 'bugfix/preserve_hci_status_on_set_scan_params' into 'master'
fix(ble/bluedroid): preserve HCI status on BLE 4.2 GAP failures

Closes BLERP-2905

See merge request espressif/esp-idf!49746
2026-06-26 16:51:00 +08:00
Island
106fe3da23 Merge branch 'bugfix/fix_bluedroid_static_random_conn_rpa' into 'master'
fix(ble/bluedroid): skip identity conversion for static random direct connect

Closes BCI-620

See merge request espressif/esp-idf!49754
2026-06-26 16:50:54 +08:00
Island
296c0a28f2 Merge branch 'bugfix/fix_bluedroid_legacy_directed_adv_data_validate' into 'master'
fix(ble/bluedroid): reject non-zero adv data on legacy directed ext adv

Closes BLERP-2908

See merge request espressif/esp-idf!49758
2026-06-26 16:50:51 +08:00
Island
853f4ba18e Merge branch 'bugfix/fix_gap_update_conn_params_invalid_arg' into 'master'
fix(ble/bluedroid): return ESP_ERR_INVALID_ARG for invalid conn params

Closes BLERP-2915, BLERP-2917, and BLERP-2920

See merge request espressif/esp-idf!49854
2026-06-26 16:50:47 +08:00
zhanghaipeng
0a93ccd3b3 fix(ble/bluedroid): Fixed potential double Execute Write Response 2026-06-26 15:36:43 +08:00
zhanghaipeng
2ef10ef488 fix(ble/bluedroid): skip identity conversion for static random direct connect
Do not rewrite static or non-resolvable random peer addresses to
identity type 0x03 when CONFIG_BT_BLE_RPA_SUPPORTED is enabled.
2026-06-25 19:15:25 +08:00
Island
d598b2d14d Merge branch 'feat/add_ble_core_6x_feature_for_bluedroid' into 'master'
Feat/add ble core 6x feature for bluedroid

See merge request espressif/esp-idf!49409
2026-06-25 12:01:05 +08:00
zhanghaipeng
97905afccc fix(ble/bluedroid): cap Read By Type response length at ATT maximum
Read By Type Response Length is one octet (max 255). When MTU was
large enough to return a long characteristic value in one pair, the
server wrote (UINT8)(value_len + 2) and overflowed (e.g. 513 -> 1),
so the client rejected the PDU as GATT_INVALID_PDU (0x04).

Cap server value to 253 bytes per pair, clamp the length byte, and
continue long reads via Read Blob when the capped size is returned.
2026-06-25 10:49:39 +08:00
yangfeng
16fa00e3b2 fix: Fix the critical issues of btu and bt_common from AI review report
- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events
2026-06-25 10:43:29 +08:00
zhiweijian
919622c01c feat(ble/bluedroid): add CS Security Requirements host support (Core 6.3) 2026-06-24 17:54:53 +08:00
zhiweijian
3844e24207 feat(ble/bluedroid): add LE UTP host support (Core 6.2) 2026-06-24 17:54:53 +08:00
zhiweijian
2a8a96d650 feat(ble/bluedroid): add Shorter Connection Intervals host support (Core 6.2)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-24 17:54:53 +08:00
zhiweijian
d568f2f151 feat(ble/bluedroid): add LL Extended Feature Set host support (Core 6.0) 2026-06-24 16:53:37 +08:00
zhiweijian
5372ce03a3 feat(ble/bluedroid): add Frame Space Update host support (Core 6.0)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-24 16:52:45 +08:00
zhiweijian
e20d3f0197 feat(ble/bluedroid): add DBAF host support (Core 6.0) 2026-06-24 16:00:19 +08:00
zhanghaipeng
29ae92f4ef fix(ble/bluedroid): unblock sync HCI cmd on Command Status error
Release the BLE sync semaphore and record HCI status when a
synchronous command is rejected via Command Status, since no
Command Complete event follows.
2026-06-24 15:32:50 +08:00
yangfeng
169a29defc fix(bt): Fix the high issues related to AVRCP from AI review report
- SDP/registration: handle SDP record creation and discovery failures safely
- AVRC stack: fix packet checks, fragment leaks, response build, and compile guards
- BTC AVRCP: fix return codes, connection state, metadata parsing, and memory leaks
- AVCTP: fix event passing, L2CAP conflicts, TX queue leaks, and disconnect handling
- Example: remove TG RN capability setup before initialization
2026-06-24 11:20:09 +08:00
yangfeng
3210f4eea5 fix(bt): Fix the critical issues related to AVRCP from AI review report
- recalculate len_left per attribute in avrc_bld_app_setting_text_rsp
- abort fragmented message reassembly when reassembly buffer alloc fails
2026-06-24 11:20:09 +08:00
yangfeng
0dce2d707d fix(bt): Fix the critical issues related to A2DP from AI review report
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Reject source audio send when A2DP is deiniting
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
2026-06-23 20:15:48 +08:00
zhanghaipeng
f9eaeb5e84 fix(ble/bluedroid): report conn param update failure for unknown BD_ADDR
Route unknown BD_ADDR and other immediate failures through the existing
need_cb path so ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT is always delivered.
2026-06-22 14:08:16 +08:00
zhanghaipeng
7d1c0e9a32 feat(ble/bluedroid): Optimize Bluedroid memory usage
- Delete unused device records (~356B each)
2026-06-22 11:17:27 +08:00
Wang Meng Yang
3963be89f4 Merge branch 'bugfix/bbp_515' into 'master'
fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd

Closes BT-4397

See merge request espressif/esp-idf!49672
2026-06-18 14:39:05 +08:00
zhanghaipeng
c339cec380 fix(ble/bluedroid): reject adv data on legacy directed ext adv 2026-06-17 17:50:29 +08:00
zhanghaipeng
47dd785a18 fix(ble/bluedroid): preserve HCI status on BLE 4.2 GAP failures
Return BTM_HCI_ERROR | hci_status from legacy BLE 4.2 GAP HCI command
paths instead of mapping failures to BTM_ILLEGAL_VALUE or
BTM_NO_RESOURCES. Add btm_ble_status_from_hci() helper and propagate
real status through scan start/stop completion callbacks.
2026-06-17 11:37:39 +08:00
Island
57b3b1777a Merge branch 'feat/ble-smp-multi-adv-static-random-address' into 'master'
feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses

Closes BLERP-2698

See merge request espressif/esp-idf!49011
2026-06-16 15:24:26 +08:00
Jin Cheng
bd60b1c267 fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd 2026-06-15 20:26:15 +08:00
zhanghaipeng
7986e2faa8 feat(ble/bluedroid): Add BLE SMP support for multi-ADV with static random addresses 2026-06-15 14:41:51 +08:00
Wang Meng Yang
8160f8d5f5 Merge branch 'bugfix/bbp_481' into 'master'
fix(bt/bluedroid): added buffer length check for OBEX APIs

Closes BT-4367

See merge request espressif/esp-idf!49437
2026-06-12 18:30:32 +08:00
Jin Cheng
6979093544 fix(bt/bluedroid): added buffer length check for HID Device data indication 2026-06-12 12:18:02 +08:00
Wang Meng Yang
9a3bfb907c Merge branch 'bugfix/bbp_499' into 'master'
fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received

Closes BT-4389

See merge request espressif/esp-idf!49429
2026-06-11 12:36:20 +08:00
Wang Meng Yang
388ea06692 Merge branch 'bugfix/bbp_478' into 'master'
fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode

Closes BT-4387

See merge request espressif/esp-idf!49434
2026-06-11 12:34:43 +08:00
Wang Meng Yang
82c640784f Merge branch 'bugfix/bbp_479' into 'master'
fix(bt/bluedroid): added buffer length check for HID host data indication

Closes BT-4366

See merge request espressif/esp-idf!49435
2026-06-11 10:01:12 +08:00
Jin Cheng
149743a8d5 fix(bt/bluedroid): fixed CTKD link key authentication downgrade in SC-Only mode 2026-06-10 08:43:42 +08:00
Jin Cheng
c8cd8f4f30 fix(bt/bluedroid): added buffer length check for L2CAP related functions 2026-06-09 17:57:46 +08:00
Jin Cheng
06a53ca900 fix(bt/bluedroid): added buffer length check for OBEX APIs 2026-06-09 17:57:08 +08:00
Jin Cheng
5a3d291bef fix(bt/bluedroid): added buffer length check for HID host data indication 2026-06-09 17:55:35 +08:00
Jin Cheng
d6a49aedef fix(bt/bluedroid): added validation for all SMP BR opcode lengths in smp_br_data_received 2026-06-09 17:11:08 +08:00
yangfeng
6028243598 fix: Fix missing handling for HCI_ERR_CONNECTION_EXISTS
- Closes https://github.com/espressif/esp-idf/issues/18562
2026-06-04 19:13:38 +08:00
Island
f17466af04 Merge branch 'opt/optimize_ble_document' into 'master'
Opt/optimize ble document

Closes BLERP-2844

See merge request espressif/esp-idf!48819
2026-06-01 19:23:27 +08:00
zhanghaipeng
1a9f2af505 feat(ble/bluedroid): add auto-setting for is_aux parameter in esp_ble_gattc_enh_open 2026-05-29 10:16:21 +08:00
zhiweijian
c9d13aaf64 fix(ble/bluedroid): fix HCI command and BTU robustness 2026-05-29 10:15:11 +08:00
zhiweijian
54a1e31916 fix(ble/bluedroid): fix GATT server lifecycle and callbacks 2026-05-29 10:15:02 +08:00